Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🚨 CVE-2024-36420 - high 🚨 Flowise 1.4.3 - Arbitrary File Read > Flowise 1.4.3 contains a path traversal caused by lack of sanitization of 'fileName' ... 👾 https://cloud.projectdiscovery.io/library/CVE-2024-36420 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE-2024-36420, a path traversal vulnerability in Flowise 1.4.3 that allows arbitrary file read, with a link to further details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | flowiseai | flowise | 1.4.3 | - | - |