---
title: "GHSA-99pg-hqvx-r4gf: Flowise has an Arbitrary File Read"
url: https://erroneo.us/security/ghsa/GHSA-99pg-hqvx-r4gf/
description: "GHSA-99pg-hqvx-r4gf (critical, npm): Flowise has an Arbitrary File Read. Summary An arbitrary file read vulnerability in the chatId parameter supplied to…"
type: advisory
section: "Security Digest"
date_published: 2025-09-15
date_modified: 2026-07-21
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-99pg-hqvx-r4gf"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-99pg-hqvx-r4gf: Flowise has an Arbitrary File Read

## Affected packages

- npm `flowise` = 3.0.5 → fixed: 3.0.6

## Details

Summary An arbitrary file read vulnerability in the chatId parameter supplied to both the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints allows unauthenticated users to read unintended files on the local filesystem. In the default Flowise configuration this allows reading of the local sqlite db and subsequent compromise of all database content. Details Both the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints accept the chatId parameter and pass this to a subsequent call to streamStorageFile(). While streamStorageFile validates that the chatflowId is a UUID and strips traversal sequences from fileName, it performs no validation of chatId. There is validation that the resulting filePath is restricted to the /root/.flowise/storage directory. However, if the file is not found in the specified path, the orgId value is removed from the filePath and reattempted. As this fallback path is read after the /root/.flowise/storage check, this allows an additional level of traversal up to /root/.flowise/. As a result, this allows reading of /root/.flowise/database.sqlite, which contains all database content in the default Flowise configuration. REQUEST RESPONSE Similarly, for /api/v1/openai-assistants-file/download: REQUEST RESPONSE This includes all API keys used by the application (apiKey table), which can be used to gain administrative access. As the fallback logic attempts to move the file to the initially checked directory, this results in the server permanently being unable to make new read or write operations until the file is moved and the server is restarted. Interaction with these endpoints requires knowledge of a valid chatflowId. As a UUID, this is inherently unguessable. However, the /api/v1/vector/upsert/ endpoint can be used without a chatflowId, defaulting to the first ID available. This endpoint returns a verbose error when receiving a malformed filename, revealing the full internal file path and the associated chatflowId. REQUEST RESPONSE In this case the UUID is revealed as 188903b1-d06d-4f93-9415-400015b87146, which can then be used to exploit the file read vulnerability. PoC Run Flowise: Complete install & create a Chatflow:

## Sources

- [GitHub Advisory GHSA-99pg-hqvx-r4gf](https://github.com/advisories/GHSA-99pg-hqvx-r4gf)
- [github.com](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf)

---
Source page: https://erroneo.us/security/ghsa/GHSA-99pg-hqvx-r4gf/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt