CVE-2026-12821: FlowiseAI Path Traversal Vulnerability

CVE-2026-12821 Overview

CVE-2026-12821 is a path traversal vulnerability in FlowiseAI Flowise versions up to 3.1.2. The flaw resides in the S3 Document Loader component, specifically in packages/components/nodes/documentloaders/S3/S3.ts. An authenticated remote attacker can manipulate the S3 object key parameter to traverse directory boundaries and access files outside the intended scope. The vendor was contacted prior to public disclosure but did not respond. No official patch has been published at the time of writing.

Critical Impact
Authenticated remote attackers can leverage the S3 Document Loader to perform path traversal [CWE-22], exposing files outside the intended directory scope within Flowise deployments.

Affected Products

FlowiseAI Flowise versions up to and including 3.1.2
Deployments using the S3 Document Loader node (S3.ts)
Self-hosted and containerized Flowise instances exposing the document loader API

Discovery Timeline

2026-06-22 - CVE-2026-12821 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12821

Vulnerability Analysis

FlowiseAI Flowise is a low-code platform for building LLM applications and AI agents. The S3 Document Loader node ingests documents from Amazon S3 buckets for downstream retrieval-augmented generation (RAG) workflows. The loader accepts an object key parameter that is passed without adequate validation to file-handling logic in packages/components/nodes/documentloaders/S3/S3.ts.

Because the object key is not sanitized for path traversal sequences, an attacker who can configure or invoke the loader can supply crafted values containing ../ segments or absolute paths. The handler then resolves these references against the local filesystem during temporary file operations, breaking out of the intended working directory.

The vulnerability requires low-privileged authentication to the Flowise application. Successful exploitation yields limited confidentiality, integrity, and availability impact according to the CVSS 4.0 vector. A public proof-of-concept exists in the form of a vulnerability report on GitHub.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The S3 Document Loader concatenates user-controlled object key input into filesystem paths without normalizing or validating that the resolved path remains within an allowed base directory.

Attack Vector

The attack is launched over the network against the Flowise API. An authenticated user with permission to create or modify S3 Document Loader nodes supplies an object key value embedding directory traversal sequences. When Flowise processes the loader, the traversal resolves on the server filesystem, granting access to files outside the loader's intended scope.

No verified exploit code is published in this advisory. Refer to the GitHub Vulnerability Report and VulDB CVE-2026-12821 for technical details.

Detection Methods for CVE-2026-12821

Indicators of Compromise

Flowise application logs containing S3 Document Loader requests with object key values that include ../, ..\, or absolute path prefixes such as /etc/ or C:\.
Unexpected file read activity by the Flowise process targeting paths outside its installation or working directory.
Outbound transmission of local filesystem contents through Flowise chatflow or API responses.

Detection Strategies

Inspect HTTP request bodies to Flowise node configuration endpoints for traversal patterns in the S3 Key field.
Monitor the Flowise process for filesystem open() or readFile() calls referencing paths outside the expected document root.
Correlate authenticated Flowise user sessions with anomalous configuration changes to S3 Document Loader nodes.

Monitoring Recommendations

Enable verbose application logging for the documentloaders/S3 component and forward logs to a centralized SIEM for retention and rule-based alerting.
Baseline normal S3 object key values used by legitimate workflows and alert on deviations containing path separators or relative path tokens.
Track filesystem access patterns of the Node.js process hosting Flowise to identify reads outside its working directory.

How to Mitigate CVE-2026-12821

Immediate Actions Required

Restrict network access to Flowise instances so only trusted authenticated users can reach the API and UI.
Audit existing S3 Document Loader configurations for object key values containing ../, ..\, or absolute paths.
Revoke or downgrade Flowise accounts that do not require permission to create or edit document loader nodes.
Run the Flowise process under a dedicated low-privilege user account with filesystem access scoped to required directories only.

Patch Information

No vendor patch is currently available. The vendor did not respond to disclosure outreach as recorded in the VulDB entry. Monitor the FlowiseAI GitHub repository for security updates beyond version 3.1.2 and apply releases that address packages/components/nodes/documentloaders/S3/S3.ts once published.

Workarounds

Deploy Flowise inside a container or chroot environment that limits filesystem visibility to required application directories.
Place a reverse proxy or web application firewall in front of Flowise to block requests whose JSON bodies contain ../ sequences in S3 loader fields.
Apply mandatory access controls such as AppArmor or SELinux to confine the Flowise process to its installation directory and intended data paths.

bash

# Example AppArmor-style restriction concept for the Flowise process
# Deny read access outside the application's working directory
/opt/flowise/** r,
/tmp/flowise/** rw,
deny /etc/** r,
deny /root/** r,
deny /home/** r,