{"answers":{"affected":"4 open source packages ship an affected version, including flowise and flowise-components.","exploited":"There is no known exploitation of GHSA-88pr-878c-24wf in the wild and no public exploit code.","fix":"Upgrade flowise to 3.1.3 or later.","what":"GHSA-88pr-878c-24wf is a path traversal vulnerability in flowise, published on 4 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-88pr-878c-24wf and fix it if it is affected.\n\nWhat it is: GHSA-88pr-878c-24wf is a path traversal vulnerability in flowise, published on 4 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-88pr-878c-24wf in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- flowise (npm): affected all versions; fixed in 3.1.3\n- flowise (npm): affected all versions; fixed in 3.1.3\n- flowise-components (npm): affected all versions; fixed in 3.1.3\n- flowise-components (npm): affected all versions; fixed in 3.1.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-88pr-878c-24wf/ (Markdown: https://insights.sbomify.com/GHSA-88pr-878c-24wf/index.md)","id":"GHSA-88pr-878c-24wf","markdown":"https://insights.sbomify.com/GHSA-88pr-878c-24wf/index.md","name":"GHSA-88pr-878c-24wf","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Flowise AI platform","requires_auth":"low_privilege","summary":"Authenticated users can write arbitrary files to the server via unsanitized S3 keys, potentially leading to code execution or data modification.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary \n \n Flowise on current `main` allows an authenticated user with\n `documentStores:preview-process` permission to trigger the `S3 Directory` \n document loader with attacker-controlled S3 object keys. The loader joins\n each returned S3 key with a temporary directory using `path.join(tempDir, key)` \n and writes the object bytes to disk **without validating traversal sequences\n such as `../`**. Cleanup later removes only the original temporary directory,\n so files written outside that directory persist on the host filesystem. \n \n This yields **arbitrary file write** with the privileges of the Flowise \n server process. \n \n A related variant exists in the `S3File` loader when \n `fileProcessingMethod = unstructured` (same root cause; its cleanup behavior \n turns it into a mixed arbitrary write/delete/DoS primitive). \n \n ## Affected component \n \n - `packages/components/nodes/documentloaders/S3Directory/S3Directory.ts`\n - line **191**: `filePath = path.join(tempDir, key)` (unsanitized) \n - line **213**: recursive `mkdirSync` creates parent path \n - line **216**: `writeFileSync` writes attacker-controlled bytes \n - line **289**: cleanup only removes the original `tempDir`, so escaped \n files remain on disk \n - Related (variant): \n `packages/components/nodes/documentloaders/S3File/S3File.ts` \n (lines 756, 780, 782, 817 — arbitrary write + recursive dirname delete)\n \n ## Reachability \n \n - Routes exposed: \n `packages/server/src/routes/documentstore/index.ts:41,45` \n (`/api/v1/document-store/loader/preview`, \n `/api/v1/document-store/loader/process/:loaderId`) \n - Both require `documentStores:preview-process` \n - `packages/server/src/services/documentstore/index.ts:588` passes \n `data.loaderConfig` straight to the loader node **with no path \n sanitization** \n - `S3Directory` accepts a custom `serverUrl`, so the attacker does **not\n need access to an existing trusted AWS bucket** — they can point Flowise \n at a local MinIO or any S3-compatible endpoint they control \n \n ## Impact","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Flowise on current `main` allows an authenticated user with `documentStores:preview-process` permission to trigger the `S3 Direct","id":"GHSA-88pr-878c-24wf","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["3.1.3"],"introduced":["0"],"last_affected":[],"package":"flowise","purl":null,"source":"GHSA-88pr-878c-24wf"},{"ecosystem":"npm","fixed":["3.1.3"],"introduced":["0"],"last_affected":[],"package":"flowise","purl":"pkg:npm/flowise","source":"GHSA-88pr-878c-24wf"},{"ecosystem":"npm","fixed":["3.1.3"],"introduced":["0"],"last_affected":[],"package":"flowise-components","purl":null,"source":"GHSA-88pr-878c-24wf"},{"ecosystem":"npm","fixed":["3.1.3"],"introduced":["0"],"last_affected":[],"package":"flowise-components","purl":"pkg:npm/flowise-components","source":"GHSA-88pr-878c-24wf"}],"products":null,"published":"2026-08-04","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users can write arbitrary files to the server via unsanitized S3 keys, potentially leading to code execution or data modification.","url":"https://insights.sbomify.com/GHSA-88pr-878c-24wf/"}