by Kastro
Paper/Archive/CVE-2025-71333

CVE-2025-71333

Flowise Flowise — Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 59.6.596 × 2011.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

Affected

ProductAffectedFixed inSource
Flowise≤ 2.2.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6gwriteupvulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint