Advisory details:
github_osv / GHSA-88pr-878c-24wf
| Advisory ID | github_osv/GHSA-88pr-878c-24wf |
| Aliases | |
| Summary | Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys ## Summary Flowise on current `main` allows an authenticated user with `documentStores:preview-process` permission to trigger the `S3 Directory` document loader with attacker-controlled S3 object keys. The loader joins each returned S3 key with a temporary directory using `path.join(tempDir, key)` and writes the object bytes to disk **without validating traversal sequences such as `../`**. Cleanup later removes only the original temporary directory, so files written outside that directory persist on the host filesystem. This yields **arbitrary file write** with the privileges of the Flowise server process. A related variant exists in the `S3File` loader when `fileProcessingMethod = unstructured` (same root cause; its cleanup behavior turns it into a mixed arbitrary write/delete/DoS primitive). ## Affected component - `packages/components/nodes/documentloaders/S3Directory/S3Directory.ts` - line **191**: `filePath = path.join(tempDir, key)` (unsanitized) - line **213**: recursive `mkdirSync` creates parent path - line **216**: `writeFileSync` writes attacker-controlled bytes - line **289**: cleanup only removes the original `tempDir`, so escaped files remain on disk - Related (variant): `packages/components/nodes/documentloaders/S3File/S3File.ts` (lines 756, 780, 782, 817 — arbitrary write + recursive dirname delete) ## Reachability - Routes exposed: `packages/server/src/routes/documentstore/index.ts:41,45` (`/api/v1/document-store/loader/preview`, `/api/v1/document-store/loader/process/:loaderId`) - Both require `documentStores:preview-process` - `packages/server/src/services/documentstore/index.ts:588` passes `data.loaderConfig` straight to the loader node **with no path sanitization** - `S3Directory` accepts a custom `serverUrl`, so the attacker does **not need access to an existing trusted AWS bucket** — they can point Flowise at a local MinIO or any S3-compatible endpoint they control ## Impact - Authenticated arbitrary file write to any path writable by the Flowise process - Destructive overwrite of application data, secrets, or configuration - Deployment-dependent lift to RCE if the service account can modify executable, startup, or interpreter-loaded files (e.g. `.bashrc`, systemd units, cron files, `require.resolve` targets, `package.json` postinstall scripts). This is not guaranteed product-wide. ## Preconditions - Flowise instance running (HTTP server mode) - Attacker has a workspace account with the `documentStores:preview-process` role - No additional infrastructure required — `serverUrl` can point to attacker-controlled S3-compatible endpoint ## Proof of Concept 1. Authenticate as a user with `documentStores:preview-process` 2. Run an S3-compatible server the attacker controls (e.g. MinIO) 3. Create an object with a traversal key such as: `../../../../tmp/flowise-poc.txt` 4. Trigger: POST /api/v1/document-store/loader/preview (or /api/v1/document-store/loader/process/:loaderId) body: { "loaderId": "s3Directory", "loaderConfig": { "serverUrl": "http://attacker-minio:9000", "bucketName": "attacker-bucket", "prefix": "", "credential": "" } } 5. Observe that Flowise writes the object bytes to the escaped path 6. Observe that cleanup removes only the original temp directory; the escaped file persists Local reproduction confirmed: writing a key containing `../../escape-target/poc.txt` from a nested temp root created the file outside the temp directory, and the cleanup removed only `tempDir`. ## Root Cause The loader trusts S3 object keys as safe local relative paths. It should canonicalize the destination with `path.resolve(...)`, verify the resolved path remains within the intended temp directory, and reject traversal or absolute-path patterns before any directory creation or file write. ## Suggested Remediation The repository already has shared path validators that are not used here: - `packages/components/src/validator.ts:35` defines traversal checks - `packages/components/src/validator.ts:295` defines `sanitizeFileName` Recommended fix: 1. Replace `path.join(tempDir, key)` with a resolve-and-verify flow 2. Reject any resolved path outside `tempDir` 3. Prefer a sanitized basename if directory structure is not required 4. Apply the same fix to the `S3File` loader (`fileProcessingMethod = unstructured` branch) |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.5 |
| Risk | 3.2 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 7.2 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-88pr-878c-24wf/GHSA-88pr-878c-24wf.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
There are no SSVC decisions available.