Flowise SQL Injection Vulnerability in Import Chatflows API

# Flowise SQL Injection Vulnerability in Import Chatflows API

https://gcdradar.vercel.app/incidents/flowise-sql-injection-vulnerability-in-import-chatflows-api · AIR-2026-0027 · closed 2025-04-07

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-04-07 (happened 2026-06-24)
- AI role: Attack on AI
- Products: Flowise
- CVE ids: CVE-2025-71332
- CVSS: 5.9

## Summary

Flowise up to version 2.2.7 suffers from a SQL injection vulnerability within the importChatflows API endpoint. Authenticated users can supply crafted JSON files to execute arbitrary SQL statements and extract credential table data.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-06-24: CVE-2025-71332: Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. (https://nvd.nist.gov/vuln/detail/CVE-2025-71332)
- 2025-04-07: CVE-2025-71332: FlowiseDB vulnerable to SQL Injection by authenticated users (https://github.com/advisories/GHSA-9c4c-g95m-c8cp)

## Sources

- 2025-04-07 GitHub Advisory Database: CVE-2025-71332: FlowiseDB vulnerable to SQL Injection by authenticated users https://github.com/advisories/GHSA-9c4c-g95m-c8cp
- 2026-06-24 NVD: CVE-2025-71332: Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. https://nvd.nist.gov/vuln/detail/CVE-2025-71332

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.