CVE-2025-71333

critical · 9.3

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

9.3

CVSS

0.9%

EPSS (exploit prob.)

58th

EPSS percentile

2026-06-25

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-73

Affected products

Vendor	Product	Affected versions
flowiseai	flowise	<= 2.2.4

Check a specific version with /api/v1/cve/match.

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g
https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-71333