{"id":"EUVD-2025-6168","enisaUuid":"ef6755bf-a63c-3a3b-9866-43f6b6f4512a","description":"FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.","datePublished":"Mar 4, 2025, 12:00:00 AM","dateUpdated":"Mar 5, 2025, 4:45:28 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/dorattias/CVE-2025-26319\n","aliases":"CVE-2025-26319\nGHSA-69jq-qr7w-j7qh\n","assigner":"mitre","epss":55.87,"enisaIdProduct":[{"id":"2797a607-4b56-3b83-b7fe-93cec6b3f645","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"ce88e875-e5cc-3f5f-8bef-9b4ffd30886b","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"0cffb097-417e-3e65-a569-09fead540653","vulnerability":{"id":"GHSA-69jq-qr7w-j7qh","description":"FlowiseAI Flowise arbitrary file upload vulnerability","datePublished":"Mar 5, 2025, 12:30:35 AM","dateUpdated":"Mar 5, 2025, 6:37:33 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-26319\nhttps://github.com/FlowiseAI/Flowise\nhttps://github.com/FlowiseAI/Flowise/blob/flowise-ui%402.2.6/packages/server/src/index.ts#L165-L190\nhttps://github.com/dorattias/CVE-2025-26319\n","enisa_id":"EUVD-2025-6168\n","aliases":"GHSA-69jq-qr7w-j7qh\nCVE-2025-26319\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:11:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c654e68a-3631-3d98-b0f5-aa7ede9479aa","vulnerability":{"id":"CVE-2025-26319","description":"FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.","datePublished":"Mar 4, 2025, 12:00:00 AM","dateUpdated":"Mar 5, 2025, 4:45:28 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/dorattias/CVE-2025-26319\n","enisa_id":"EUVD-2025-6168\n","assigner":"mitre","epss":55.87,"dataProcessed":"Oct 31, 2026, 7:16:21 AM","vulnerabilityProduct":[{"id":"4f81a6a4-960f-3c6e-91de-47b2c10318d8","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"},{"id":"7f046760-ba3e-4c82-9c6e-bfa07e57e251","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"9627be72-2898-3857-96ec-4e97564a74b8","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[{"id":"a512506a-e693-319a-9848-d102f1be8653","advisory":{"id":"WID-SEC-W-2025-0568","description":"Flowise: Schwachstelle ermöglicht Codeausführung","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Flowise ausnutzen, um beliebigen Programmcode auszuführen.","datePublished":"Mar 13, 2025, 11:00:00 PM","dateUpdated":"Mar 13, 2025, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0568.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-0568\n","aliases":"CVE-2025-26319\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"41a8c256-0c9b-3ded-8042-8bcc1ebcf285","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}}},{"id":"5efba50c-229f-3f6d-a52a-3ad143ab1ab2","product":{"name":"Open Source Flowise \u003c\u003d2.2.4","vendor":{"name":"open source"}}}]}}]}