Unrated severityNVD Advisory· Published Jun 21, 2026
FlowiseAI Flowise S3 Document Loader S3.ts path traversal
CVE-2026-12821
Description
A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file packages/components/nodes/documentloaders/S3/S3.ts of the component S3 Document Loader. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
5- vuldb.com/cve/CVE-2026-12821mitrethird-party-advisory
- vuldb.com/submit/837578mitrethird-party-advisory
- github.com/dxz0069/softwareoverflow/blob/main/flowise_s3_loader_object_key_path_traversal_vulndb.mdmitrerelated
- vuldb.com/vuln/372611mitrevdb-entry
- vuldb.com/vuln/372611/ctimitresignaturepermissions-required
News mentions
1- Flowise: Nine Vulnerabilities Including RCE and SSRF Disclosed in BatchVypr Intelligence · Jun 23, 2026