FlowiseAI Flowise up to 3.1.2 File Management /api/v1/files getAllFiles/deleteFile path permission

Summaryinfo

A vulnerability categorized as critical has been discovered in FlowiseAI Flowise up to 3.1.2. Affected by this issue is the function getAllFiles/deleteFile of the file /api/v1/files of the component File Management. The manipulation of the argument path results in permission. This vulnerability was named CVE-2026-69252. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in FlowiseAI Flowise up to 3.1.2. Affected is the function getAllFiles/deleteFile of the file /api/v1/files of the component File Management. The manipulation of the argument path with an unknown input leads to a permission vulnerability. CWE is classifying the issue as CWE-275. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organization because getAllFiles and deleteFile used activeOrganizationId and a user-controlled path without restricting access by permissions or activeWorkspaceId. This issue is fixed in version 3.1.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-69252 since 08/03/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1222.

Upgrading to version 3.1.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• FlowiseAI

Name

• Flowise

Version

• 3.1.0
• 3.1.1
• 3.1.2

Website

• Product: https://github.com/FlowiseAI/Flowise/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion