Exploit for Missing Authentication for Critical Function in Flowiseai Flowise

## https://sploitus.com/exploit?id=592548B4-51DF-584A-88B5-1636E07D3410
# CVE-2025-58434 - Flowise (CVE-2025-58434) unauthenticated account takeover via password-reset token disclosure

Standalone exploit for CVE-2025-58434 in Flowise: the forgot-password flow returns the reset token in the API response, allowing unauthenticated takeover of any account including the first admin. Chained helpers cover a CustomMCP mcpServerConfig server-side JavaScript evaluation RCE and a Gogs (CVE-2025-8110) symlink-based arbitrary file write for local privilege escalation.

**CVE:** CVE-2025-58434 CVE-2025-8110

## Requirements

```bash
python3 -m pip install requests    # for the Python PoC(s)
```

## Usage

### `flowise_ato_foothold.py`

```bash
python3 flowise_ato_foothold.py 
```

### `flowise_customMCP_rce.py`  (standalone CustomMCP RCE)

```bash
python3 flowise_customMCP_rce.py 
```

### `gogs_register.py`

```bash
python3 gogs_register.py 
```

### `gogs_symlink_root.sh`

```bash
./gogs_symlink_root.sh 
```

## How it works

1. ### Foothold — Flowise account takeover to CustomMCP RCE
2. ### User — container env-var to SSH as the target user
3. ### Root — Gogs CVE-2025-8110 symlink write

## Disclaimer

For authorised security testing and education only. Only run this against
systems you own or have **explicit written permission** to test.

---
Author: **r3vpwnx**