CVE-2025-71333

CVE-2025-71333 · Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

CVSS 9.3 · Critical · EPSS 0.9%

Published: 2026-06-25T21:41:04.896Z
Updated: 2026-06-27T02:32:21.615Z

Stack: node

Affected products and versions

flowise
Versions
- ≥ 0, ≤ 2.2.4: Affected (semver)
No fix published
flowise npm
Affected ranges
- SEMVER: ≤ 2.2.7
No fix published

Original sources

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g
https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint
https://nvd.nist.gov/vuln/detail/CVE-2025-71333

Check your server →

CVE-2025-71333 · Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint

Affected products and versions

flowise

flowise npm

Original sources