Path Traversal Vulnerability in Flowise by FlowiseAI

CVE-2026-56273

What is CVE-2026-56273?

Flowise, prior to version 3.1.0, is vulnerable to a path traversal issue in its Faiss and SimpleStore vector store implementations. This vulnerability arises from the handling of unsanitized basePath parameters provided by authenticated users. If exploited, attackers with valid API tokens can manipulate the vector store data, enabling potential unauthorized access to write data to arbitrary filesystem locations. This could consequently lead to severe security breaches, like code execution or data exfiltration.

References