CVE-2025-71333

9.8 Critique

Publiée le 26/06/2026 à 00:16 · Modifiée le 12/10/2026 à 23:10 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.3 Critique	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	9.8 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-73

Références

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g Vendor AdvisoryExploit
https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint Third Party Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g Vendor AdvisoryExploit

CVE-2025-71333

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs