CVE-2025-71333
published 2026-06-25CVE-2025-71333: Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local…
PriorityP264critical9.3CVSS 4.0
AVNACLATNPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.52%
40.0th percentile
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flowise | flowise | <= 2.2.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local.
ghsa_unreviewed·2026-06-26
CVE-2025-71333 [CRITICAL] CWE-73 Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local.
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.
VulDB
Flowise up to 2.2.4 /api/v1/attachments chatflowId file inclusion (GHSA-h42x-xx2q-6v6g)
vuldb·2026-06-26·CVSS 9.3
CVE-2025-71333 [CRITICAL] Flowise up to 2.2.4 /api/v1/attachments chatflowId file inclusion (GHSA-h42x-xx2q-6v6g)
A vulnerability identified as critical has been detected in Flowise up to 2.2.4. The affected element is an unknown function of the file /api/v1/attachments. Performing a manipulation of the argument chatflowId results in file inclusion.
This vulnerability is identified as CVE-2025-71333. The attack can be initiated remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-25
Published