{
 "id": "AIR-2025-0341",
 "slug": "ghsa-99pg-hqvx-r4gf-flowise-arbitrary-file-read",
 "title": "Flowise Arbitrary File Read",
 "summary": "An arbitrary file read vulnerability in Flowise endpoints allows unauthenticated users to read local files, including the local SQLite database. The issue stems from insufficient parameter validation in file download routines.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Flowise"
 ],
 "incident_date": "2025-09-15",
 "incident_date_precision": "day",
 "first_reported": "2025-09-15",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-99pg-hqvx-r4gf",
   "publisher": "GitHub Advisory Database",
   "title": "GHSA-99pg-hqvx-r4gf: Flowise has an Arbitrary File Read",
   "published_at": "2025-09-15"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "ghsa-99pg-hqvx-r4gf",
  "file-read"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:14:26.300Z"
}