CVE-2024-36420 Scanner
CVE-2024-36420 Scanner - Arbitrary File Read vulnerability in Flowise
Used 2.8k times · 4.2k assets checked · domain, subdomain, ipv4
CVE
CVE-2024-36420
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
flowise
Updated Nov 7, 2026View on NVD →
S4E scanner
CVE history: flowise
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →