Vulnerability Description
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flowiseai | Flowise | <= 2.2.4 |
Related Weaknesses (CWE)
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6gVendor AdvisoryExploit
- https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthentThird Party Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6gVendor AdvisoryExploit
FAQ
What is CVE-2025-71333?
CVE-2025-71333 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the ...
How severe is CVE-2025-71333?
CVE-2025-71333 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-71333?
Check the references section above for vendor advisories and patch information. Affected products include: Flowiseai Flowise.