Critical Flowise RCE Flaw: CVE-2025-61913 (CVSS 10.0) Allows Arbitrary File Write

The Flowise platform has a critical RCE flaw, CVE-2025-61913, with a CVSS of 10.0, that allows an authenticated attacker to write arbitrary files on the server because the WriteFileTool does not restrict the target file path. According to the security advisory, the WriteFileTool reads the file_path parameter without verifying whether it lies inside Flowise’s working directory, enabling writes to any path in the filesystem and potentially leading to remote command execution.

The advisory highlights several exploitation techniques, including writing a malicious SSH key to ~/.ssh/authorized_keys, overwriting /etc/ld.so[.]preload to hijack libraries, and modifying package.json to alter startup commands. The vulnerability affects all Flowise versions up to and including 3.0.5 and has been patched in Flowise version 3.0.6. Administrators are advised to upgrade immediately, revoke compromised credentials, and audit filesystem integrity on affected servers.

The issue underscores how a lack of path sanitisation in a tool designed for interacting with the server’s filesystem can dramatically expand an attacker’s attack surface in production deployments.