{
 "id": "AIR-2025-0338",
 "slug": "ghsa-q67q-549q-p849-flowise-arbitrary-file-access-via-missin",
 "title": "Flowise arbitrary file access via missing chat flow id validation",
 "summary": "A vulnerability in Flowise lacks proper chat flow ID validation, allowing attackers to access arbitrary files on the system. The advisory provides details on missing checks in file upload and attachment routes.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Flowise"
 ],
 "incident_date": "2025-09-15",
 "incident_date_precision": "day",
 "first_reported": "2025-09-15",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-q67q-549q-p849",
   "publisher": "GitHub Advisory Database",
   "title": "GHSA-q67q-549q-p849: Flowise has arbitrary file access due to missing chat flow id validation",
   "published_at": "2025-09-15"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "ghsa-q67q-549q-p849",
  "path-traversal"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:14:26.300Z"
}