Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck
CVE-2025-71333Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
Critical 9.3
In plain English
A critical-severity security flaw in Flowise from Flowise. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.9%top 40.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | flowise | no fix listed | GHSA-h42x-xx2q-6v6g |
Affected products (as reported)
Weakness: CWE-73 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- GitHub Security Advisory (GHSA-h42x-xx2q-6v6g) vendor-advisory
- VulnCheck Advisory: Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint third-party-advisory