CVE-2025-71332 — Flowise - SQL Injection in importChatflows API via chatflow.id Parameter
Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can suppl…
Published: 2026-06-24 · CVSS: 8.5 · CVSS 4.0
Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7