Critical severity9.8NVD Advisory· Published Jun 25, 2026· Updated Jul 1, 2026

CVE-2025-71333

Description

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

Affected products

Flowiseai/Flowise2 versions
cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*range: <=2.2.4
- (no CPE)range: <=2.2.4

Patches

Vulnerability mechanics

References

github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6gnvdVendor AdvisoryExploit
www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpointnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000