Skip to content

Commit 25f9970

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5jpg-2rj5-964c GHSA-v5w9-prxf-w882
1 parent 3556e6d commit 25f9970

File tree

2 files changed

+74
-4
lines changed

2 files changed

+74
-4
lines changed

advisories/unreviewed/2025/11/GHSA-5jpg-2rj5-964c/GHSA-5jpg-2rj5-964c.json renamed to advisories/github-reviewed/2025/11/GHSA-5jpg-2rj5-964c/GHSA-5jpg-2rj5-964c.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5jpg-2rj5-964c",
4-
"modified": "2025-11-17T06:30:14Z",
4+
"modified": "2025-11-17T19:06:36Z",
55
"published": "2025-11-17T06:30:14Z",
66
"aliases": [
77
"CVE-2025-13261"
88
],
9+
"summary": "lsFusion Platform has Path Traversal vulnerability",
910
"details": "A vulnerability was found in lsfusion platform up to 6.1. Affected is the function DownloadFileRequestHandler of the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Performing manipulation of the argument Version results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used.",
1011
"severity": [
1112
{
@@ -17,7 +18,27 @@
1718
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1819
}
1920
],
20-
"affected": [],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "Maven",
25+
"name": "lsfusion.platform:web-client"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"last_affected": "6.1"
36+
}
37+
]
38+
}
39+
]
40+
}
41+
],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -31,6 +52,10 @@
3152
"type": "WEB",
3253
"url": "https://github.com/lsfusion/platform/issues/1543#issue-3576922131"
3354
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/lsfusion/platform"
58+
},
3459
{
3560
"type": "WEB",
3661
"url": "https://vuldb.com/?ctiid.332596"
@@ -49,8 +74,8 @@
4974
"CWE-22"
5075
],
5176
"severity": "MODERATE",
52-
"github_reviewed": false,
53-
"github_reviewed_at": null,
77+
"github_reviewed": true,
78+
"github_reviewed_at": "2025-11-17T19:06:35Z",
5479
"nvd_published_at": "2025-11-17T04:15:54Z"
5580
}
5681
}

‎advisories/github-reviewed/2025/11/GHSA-v5w9-prxf-w882/GHSA-v5w9-prxf-w882.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v5w9-prxf-w882",
4+
"modified": "2025-11-17T19:06:09Z",
5+
"published": "2025-11-17T19:06:09Z",
6+
"aliases": [],
7+
"summary": "Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)",
8+
"details": "### Summary\nAn unauthenticated attacker can exploit the unprotected registration endpoint (/register) to create a new user and bypass authentication.\n### Details\nCritical vulnerability in Flowise 3.0.1 on-premise deployment allows unauthenticated attackers to exploit the /api/v1/account/register endpoint to add a new user and log in using it, enabling authentication bypass.\n\nMeaning that the register functionality is by default open, allowing attackers to create an account and use the api without any restrictions or credentials.\n\n### PoC\nA Flowise 3.0.1 instance was deployed via Docker for the purpose of this demonstration.\n![1 Docker](https://github.com/user-attachments/assets/fb0b8627-63e3-4523-881f-a0ff6352b678)\n\nAfter successful deployment the instance setup organization page allows us to register the first account in the system.\n![1 newly deployed instance](https://github.com/user-attachments/assets/39d56738-eb97-469e-b96e-61cd7cec64a8)\n\nCreating the first user [[email protected]](mailto:[email protected])\n![2 configuring account](https://github.com/user-attachments/assets/5fb94b35-c180-4d77-b209-dcff7043c457)\n\nLogin to the account\n![2 Login](https://github.com/user-attachments/assets/557e8268-099a-4519-bf86-b96a7c5f19ff)\n\nThe background request that created the first user to /api/v1/account/register \n![3 request](https://github.com/user-attachments/assets/b74b876d-b784-4142-9d46-10e90ff1b780)\n\nResponse\n![3 1 response](https://github.com/user-attachments/assets/db769da7-d241-4f0b-a99f-821fa5fdcf05)\n\nWe have found that it is possible to reuse the registration request multiple times without any restrictions to create an account and authenticate to the system using it.\n\nCrafting a new request \n{\n \"user\": {\n \"name\": \"Malicious\",\n \"email\": \"[email protected]\", \n \"type\": \"pro\",\n \"credential\": \"Password123!\"\n }\n}\n![4 attacker new register](https://github.com/user-attachments/assets/ee34b9f9-7e03-4198-affa-cf2dd2f84666)\n\nResponse with 201 code “Created”\n![4 1 created](https://github.com/user-attachments/assets/e2a49518-1566-4fe0-9cc5-2a496265974a)\n\nLogin using newly created user (attacker)\n![5 Login using attacker](https://github.com/user-attachments/assets/b6ef7eb2-d388-469d-92d7-0ca50cdd9873)\n\nSuccess login\n![6 Susccess auth bypass](https://github.com/user-attachments/assets/044376d8-f9c5-4de7-a53c-05dd2c66de83)\n\n\nAn unauthorized user can exploit this vulnerability to register an account and gain access to the Flowise API with authenticated privileges, effectively bypassing authentication. \n### Impact\n\nThis is an authentication bypass vulnerability caused by an unprotected registration endpoint (/register).\n\nUsers of Flowise 3.0.1(latest) on-premise deployments are impacted. An unauthorized attacker can exploit this vulnerability to register an account after the organization set has been completed, and gain access to the Flowise API with authenticated privileges, effectively bypassing authentication.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "flowise"
20+
},
21+
"versions": [
22+
"3.0.1"
23+
]
24+
}
25+
],
26+
"references": [
27+
{
28+
"type": "WEB",
29+
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882"
30+
},
31+
{
32+
"type": "PACKAGE",
33+
"url": "https://github.com/FlowiseAI/Flowise"
34+
}
35+
],
36+
"database_specific": {
37+
"cwe_ids": [
38+
"CWE-287"
39+
],
40+
"severity": "HIGH",
41+
"github_reviewed": true,
42+
"github_reviewed_at": "2025-11-17T19:06:09Z",
43+
"nvd_published_at": null
44+
}
45+
}

0 commit comments

Comments
 (0)