CyberRota Analysis
AI-GeneratedFlowise versions prior to 3.1.4 are vulnerable due to inadequate validation of file paths in the SQL Database Chain node, enabling authenticated attackers to write arbitrary files. This flaw can lead to the injection of malicious SQLite databases into system directories or the web root, potentially allowing for command execution or stored XSS attacks. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.