CVE-2025-71333: Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-25 · updated 2026-10-12
Weakness: CWE-73

Description

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

Affected products

FlowiseAI Flowise: through 2.2.4

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g
https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g

Get alerted when CVE-2025-71333 or the next vulnerability affects your stack