CVE-2025-26319

CRITICAL EXPLOITED NUCLEI

FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload

Title source: nuclei
STIX 2.1

Exploitation Summary

CVE-2025-26319 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including iSee857, redpack-kr, dorattias. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains a functional exploit for CVE-2025-26319, demonstrating command execution via session manipulation in OpenCode. The script includes multi-threaded scanning and payload delivery.

Description

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

Exploits (3)

github WORKING POC 40 stars
by iSee857 · pythonpoc
https://github.com/iSee857/CVE-PoC/tree/main/CVE-2025-26319.py

The repository contains a functional exploit for CVE-2025-26319, demonstrating command execution via session manipulation in OpenCode. The script includes multi-threaded scanning and payload delivery.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenCode (version unspecified)
No auth needed
Prerequisites: network access to target · OpenCode instance with vulnerable endpoint
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC
by redpack-kr · poc
https://github.com/redpack-kr/CVE-2025-26319

This exploit leverages CVE-2025-26319, a pre-authentication arbitrary file upload vulnerability in Flowise, by manipulating the `chatId` parameter in the `/api/v1/attachments` endpoint to perform path traversal and upload files to arbitrary locations on the server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Flowise (version not specified)
No auth needed
Prerequisites: Target must be a Flowise instance with the vulnerable endpoint exposed · Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by dorattias · remote
https://github.com/dorattias/CVE-2025-26319

This repository contains a link to a Medium article detailing CVE-2025-26319, a pre-authentication arbitrary file upload vulnerability in Flowise. No exploit code is provided.

Classification
Writeup 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Flowise (version not specified)
No auth needed
Prerequisites: Access to the target Flowise instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload
HIGHVERIFIEDby iamnoooob,rootxharsh,pdresearch
Shodan: title:"Flowise"
FOFA: title="Flowise"

References (1)

Core 1
Core References
Exploit, Patch, Third Party Advisory
https://github.com/dorattias/CVE-2025-26319

Scores

CVSS v3 9.8
EPSS 0.8771
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2025-03-31
CWE
CWE-434
Status published
Products (2)
flowiseai/flowise 2.2.6
npm/flowise 0npm
Published Mar 04, 2025
Tracked Since Feb 18, 2026