Description

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-15T16:17:44.317Z",
  "pubdate": "2026-09-15T16:17:44.317Z",
  "executiveSummary": "The Flowise platform, specifically versions prior to 3.1.4, contains a critical security vulnerability involving improper validation of user-supplied file paths within the SQL Database Chain node. This flaw enables an authenticated attacker to perform arbitrary file write operations on the underlying host filesystem.\nThe vulnerability is rooted in a failure to sanitize path input when establishing connections to SQLite databases. By manipulating the database path, an attacker can designate arbitrary target locations for file creation or overwriting.\nThe impact of this vulnerability is severe, potentially leading to Remote Code Execution (RCE) or stored Cross-Site Scripting (XSS). An attacker can weaponize this by writing malicious SQLite database files into sensitive system directories, injecting executable code into the application's web root, or altering configuration files.\nSuccessful exploitation requires the attacker to be authenticated to the Flowise instance. While the vulnerability exists within the application's core logic, it grants the attacker capabilities equivalent to the permissions of the user running the Flowise process, effectively compromising the integrity and availability of the host environment.",
  "technicalDetails": "The vulnerability resides in the SQL Database Chain node within Flowise versions before 3.1.4. The component responsible for handling SQLite database connections fails to perform adequate path validation or input sanitization on the file path parameters provided by the user. Consequently, the application does not enforce constraints or directory traversal protections when initializing a SQLite connection.\nThe root cause is a Path Traversal issue where the application blindly trusts user-supplied input to define the storage location of a SQLite database file. By utilizing dot-dot-slash (../) sequences or absolute paths, an attacker can escape the intended directory scope and specify an arbitrary path for file creation.\nThe attack flow follows a structured progression: First, the authenticated attacker accesses the SQL Database Chain node configuration. Second, the attacker supplies a crafted path to the database configuration field, targeting a sensitive file or directory. Third, when the application triggers the database initialization or connection sequence, it invokes the underlying SQLite driver to create or access the file at the attacker-specified path. Fourth, the application writes data to this location, resulting in the creation of a malicious file or the corruption of an existing one.\nThe post-exploitation impact is highly critical. If the attacker targets the web root, they may inject malicious scripts to facilitate stored XSS, compromising session integrity for other users. More severely, if the attacker can influence files that are parsed or executed by the server (such as configuration files or language-specific template files), they can achieve Remote Code Execution. By planting a crafted SQLite file that contains malicious payloads, an attacker can leverage subsequent application interactions to trigger execution of the injected code.\nThis vulnerability is restricted to authenticated users, meaning it requires an active session or valid credentials. However, given the nature of Flowise as a low-code platform, internal users or compromised accounts can leverage this functionality to gain persistent, elevated access to the host machine. There are no secondary network exposure requirements, as the vulnerability is triggered through standard application interaction via the web interface."
}