CVE-2025-71333
CRITICALFlowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
Title source: cnaDescription
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-h42x-xx2q-6v6g)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g
Third Party Advisory third-party-advisory
VulnCheck Advisory: Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint
Scores
CVSS v3
9.8
EPSS
0.0080
EPSS Percentile
53.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-73
Status
published
Products (2)
Flowise/Flowise
< 2.2.4
flowiseai/flowise
< 2.2.4
Published
Jun 25, 2026
Tracked Since
Jun 26, 2026