GHSA-88pr-878c-24wf: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
Summary
Flowise has a security flaw where authenticated users can write files anywhere on the server's filesystem through the S3 Directory document loader. The vulnerability occurs because the code doesn't check for path traversal sequences (like `../` which moves up directories) when processing S3 object keys, allowing an attacker to write files outside the intended temporary directory.
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://github.com/advisories/GHSA-88pr-878c-24wf
First tracked: August 4, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%