CVE-2025-71332: Flowiseai Flowise

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.

Affected products

• Flowiseai Flowise: up to and including 2.2.7

Published 2026-06-24. Last modified 2026-09-30.