CVE-2025-71333CWE-73

CVE-2025-71333

Critical · published June 26, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
59.3
In the wild
Unconfirmed
What it is

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00902 · 59.3th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-06-26T02:16Z
Affected products (1)
ProductVersionsFixed in
flowiseai/flowise≤ 2.2.4—
References (3)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g · [email protected]https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint · [email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 JUN 21:41Z
    Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
    cvelistv5