CVE-2024-36420
GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file
Résumé
GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the /api/v1/openai-assistants-file endpoint in index.ts is vulnerable to arbitrary file read due to lack of sanitization of the fileName body parameter. No known patches for this issue are available.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory securitylab.github.com
- web github.com