CVE-2025-71332

Medium

Description

Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.

SeverityMedium

CVSS6.5

Exploit probability—

ProductFlowise

PublishedJun 24, 2026

First seenJun 24, 2026

Weakness typeCWE-89SQL injection

How to fix

Vendor advisories

github.com/FlowiseAI/Flowise/security/advisories/GHSA-9c4c-g95m-c8cp

Affected products

Product	Affected versions	Fixed in
flowiseai flowise	v ≤ 2.2.7	—
flowisenpm	v ≤ 2.2.7	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.