Vulnerability Details CVE-2025-71332
Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 14.9%
CVSS Severity
CVSS v3 Score 6.5