Flowise S3 Directory/S3File Document Loader Path Traversal Arbitrary File Write

Technical Analysis

The S3Directory document loader tool joins each returned S3 object key directly with a temp directory using path.join(tempDir, key) without validating for traversal sequences, then recursively creates parent directories (mkdirSync) and writes attacker-supplied bytes (writeFileSync). An attacker who controls the S3 bucket contents (or key naming) used as a document source can craft keys containing '../' sequences to escape the intended temp directory and write files to arbitrary filesystem locations with the privileges of the Flowise server process. Cleanup logic only deletes the original tempDir, so maliciously placed files (e.g., cron jobs, web shells, config overwrites) persist after the loader run completes. This crosses the tool/agent boundary because a document-loading tool intended for benign RAG ingestion is repurposed into a filesystem-write primitive, and the S3File variant with 'unstructured' processing adds a delete/DoS capability via its cleanup path.

Affected Systems

Flowise, flowise-components

Detection Signatures

• S3 object keys containing '../' or absolute path sequences
• Unexpected file writes outside expected tempDir during document loader execution
• Monitoring path.join(tempDir, key) results for traversal outside tempDir boundary
• Log entries showing S3Directory or S3File loader writing files with unusual paths or permissions
• Newly created files/directories on host outside designated temp paths correlating with document store preview/process API calls

Remediation Steps

1. 1

   Upgrade Flowise

   Update flowise and flowise-components to a patched version beyond 3.1.2 once available, or apply vendor patch/hotfix.

2. 2

   Sanitize S3 keys

   Validate and normalize S3 object keys before joining with tempDir; reject any key containing '..', absolute path prefixes, or resolving outside the intended directory (e.g., using path.resolve and verifying the result stays within tempDir).

3. 3

   Restrict permissions

   Limit which users/roles can invoke documentStores:preview-process, and run the Flowise server process with least-privilege filesystem access to limit blast radius of arbitrary writes.

4. 4

   Harden cleanup logic

   Ensure cleanup routines track and remove all files actually written during processing, not just the original tempDir, to avoid persistence of malicious artifacts.

5. 5

   Restrict S3 source trust

   Only allow document ingestion from S3 buckets/prefixes fully trusted and controlled by the organization; treat externally writable buckets as untrusted input sources.