{"id":"GHSA-grch-cc26-w2fv","revision":null,"records":[{"revision":"4bde3929637c4151943b83296a35b82b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-71333","aliases":[],"title":"Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint","description":"Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.","state":0,"publishedAt":"2026-06-25T21:41:04.896+00:00","modifiedAt":"2026-06-27T02:32:21.615+00:00","affected":[{"ecosystem":"Vendor product","name":"Flowise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Flowise\",\n                    \"product\": \"Flowise\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/flowise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"2.2.4\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g","https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71333","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71333","identifiers":["CVE-2025-71333"]},"retained":false,"historicalAffected":[]},{"revision":"31b1a50e6a0f4879830c9385ccad38ce","observedAt":"2026-11-09T04:12:52.604+00:00","statement":{"source":"euvd","id":"EUVD-2025-210339","aliases":["CVE-2025-71333","GHSA-grch-cc26-w2fv"],"title":"Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to uplo…","description":"Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3,"severity":null}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g","https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210339","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 25, 2026, 9:41:04 PM","dateUpdated":"Jun 27, 2026, 2:32:21 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-210339","identifiers":["EUVD-2025-210339","CVE-2025-71333","GHSA-grch-cc26-w2fv"]},"retained":false,"historicalAffected":[]},{"revision":"2b508d61ffa3481d9f536a90bdf52a5f","observedAt":"2026-10-25T04:17:18.34+00:00","statement":{"source":"nvd","id":"CVE-2025-71333","aliases":[],"title":"Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to uplo…","description":"Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.","state":0,"publishedAt":"2026-06-25T22:16:59.01+00:00","modifiedAt":"2026-10-12T21:10:00.227+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g","https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71333","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-73"],"productCriteria":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-06-25T22:16:59.010","lastModified":"2026-10-12T21:10:00.227"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-71333","identifiers":["CVE-2025-71333"]},"retained":false,"historicalAffected":[]},{"revision":"3158f304653d4c34a03cb807f4207548","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-h42x-xx2q-6v6g","aliases":["CVE-2025-71333"],"title":"Flowise Pre-auth Arbitrary File Upload","description":"## Summary\nAn unauthorized attacker can leverage the whitelisted route `/api/v1/attachments` to upload arbitrary files when the `storageType` is set to **local** (default).\n\n## Details\nWhen a new request arrives, the system first checks if the URL starts with `/api/v1/`. If it does, the system then verifies whether the URL is included in the whitelist (*whitelistURLs*). If the URL is whitelisted, the request proceeds; otherwise, the system enforces authentication.\n\n@ */packages/server/src/index.ts*\n```typescript\n           this.app.use(async (req, res, next) => {\n                // Step 1: Check if the req path contains /api/v1 regardless of case\n                if (URL_CASE_INSENSITIVE_REGEX.test(req.path)) {\n                    // Step 2: Check if the req path is case sensitive\n                    if (URL_CASE_SENSITIVE_REGEX.test(req.path)) {\n                        // Step 3: Check if the req path is in the whitelist\n                        const isWhitelisted = whitelistURLs.some((url) => req.path.startsWith(url))\n                        if (isWhitelisted) {\n                            next()\n                        } else if (req.headers['x-request-from'] === 'internal') {\n                            basicAuthMiddleware(req, res, next)\n                        } else {\n                            const isKeyValidated = await validateAPIKey(req)\n                            if (!isKeyValidated) {\n                                return res.status(401).json({ error: 'Unauthorized Access' })\n                            }\n                            next()\n                        }\n                    } else {\n                        return res.status(401).json({ error: 'Unauthorized Access' })\n                    }\n                } else {\n                    // If the req path does not contain /api/v1, then allow the request to pass through, example: /assets, /canvas\n                    next()\n                }\n            }\n```\n\n**The whitelist is defined as follows**\n\n```typescript\nexport const WHITELIST_URLS = [\n    '/api/v1/verify/apikey/',\n    '/api/v1/chatflows/apikey/',\n    '/api/v1/public-chatflows',\n    '/api/v1/public-chatbotConfig',\n    '/api/v1/prediction/',\n    '/api/v1/vector/upsert/',\n    '/api/v1/node-icon/',\n    '/api/v1/components-credentials-icon/',\n    '/api/v1/chatflows-streaming',\n    '/api/v1/chatflows-uploads',\n    '/api/v1/openai-assistants-file/download',\n    '/api/v1/feedback',\n    '/api/v1/leads',\n    '/api/v1/get-upload-file',\n    '/api/v1/ip',\n    '/api/v1/ping',\n    '/api/v1/version',\n    '/api/v1/attachments',\n    '/api/v1/metrics'\n]\n```\nThis means that every route in the whitelist does not require authentication. Now, let's examine the `/api/v1/attachments` route.\n\n@ */packages/server/src/routes/attachments/index.ts*\n```typescript\nconst router = express.Router()\n// CREATE\nrouter.post('/:chatflowId/:chatId', getMulterStorage().array('files'), attachmentsController.createAttachment)\nexport default router\n```\nAfter several calls, the request reaches the `createFileAttachment` function @ (*packages/server/src/utils/createAttachment.ts*)\nInitially, the function retrieves *chatflowid* and *chatId* from the request without any additional validation. The only check performed is whether these parameters exist in the request.\n\n```typescript\n    const chatflowid = req.params.chatflowId\n    if (!chatflowid) {\n        throw new Error(\n            'Params chatflowId is required! Please provide chatflowId and chatId in the URL: /api/v1/attachments/:chatflowId/:chatId'\n        )\n    }\n\n    const chatId = req.params.chatId\n    if (!chatId) {\n        throw new Error(\n            'Params chatId is required! Please provide chatflowId and chatId in the URL: /api/v1/attachments/:chatflowId/:chatId'\n        )\n    }\n```\n\nNext, the function retrieves the uploaded files and attempts to add them to the storage by calling the `addArrayFilesToStorage` function.\n\n```typescript\nconst files = (req.files as Express.Multer.File[]) || []\n    const fileAttachments = []\n    if (files.length) {\n        // ...\n        for (const file of files) {\n            const fileBuffer = await getFileFromUpload(file.path ?? file.key)  // get the uploaded file\n            const fileNames: string[] = []\n            file.originalname = Buffer.from(file.originalname, 'latin1').toString('utf8')\n            // add it to the storage\n            const storagePath = await addArrayFilesToStorage(file.mimetype, \n                                                             fileBuffer,\n                                                             file.originalname,\n                                                             fileNames,\n                                                             chatflowid, chatId) // add it to the storage\n\n            // ...\n\n            await removeSpecificFileFromUpload(file.path ?? file.key) // delete from tmp\n           //  ...\n\n                fileAttachments.push({\n                    name: file.originalname,\n                    mimeType: file.mimetype,\n                    size: file.size,\n                    content\n                })\n            } catch (error) {\n                throw new Error(`Failed operation: createFileAttachment - ${getErrorMessage(error)}`)\n            }\n        }\n    }\n\n    return fileAttachments\n```\n\nNow lets take a look at `addArrayFilesToStorage` function @ (*/packages/components/src/storageUtils.ts*)\n\n```typescript\nexport const addArrayFilesToStorage = async (mime: string, bf: Buffer, fileName: string, fileNames: string[], ...paths: string[]) => {\n    const storageType = getStorageType()\n\n    const sanitizedFilename = _sanitizeFilename(fileName)\n    if (storageType === 's3') {\n      // ...\n    } else {\n        const dir = path.join(getStoragePath(), ...paths) // PATH TRAVERSAL.\n        if (!fs.existsSync(dir)) {\n            fs.mkdirSync(dir, { recursive: true })\n        }\n        const filePath = path.join(dir, sanitizedFilename)\n        fs.writeFileSync(filePath, bf)\n        fileNames.push(sanitizedFilename)\n        return 'FILE-STORAGE::' + JSON.stringify(fileNames)\n    }\n}\n```\n\nAs noted in the comment, to construct the directory, the function joins the output of the `getStoragePath` function with `...paths`, which are essentially the `chatflowid` and `chatId` extracted earlier from the request.\nHowever, as mentioned previously, these values are not validated to ensure they are UUIDs or numbers. As a result, an attacker could manipulate these variables to set the **dir** variable to any value.\nCombined with the fact that the filename is also provided by the user, this leads to **unauthenticated arbitrary file upload**.\n\n## POC\nThis is the a HTTP request. As observed, we are not authenticated, and by manipulating the `chatId` parameter, we can perform a path traversal. In this example, we overwrite the `api.json` file, which contains the API keys for the system.\n\n![File Uplaod Vulnerability.](https://lh3.googleusercontent.com/d/1zcr-MSJUnRbGRmnoD_meo5uh8Hf8FaEK)\n\n> in this example, the **dir** variable will be\n```typescript\nvar dir = '/root/.flowise/storage/test/../../../../../../../../root/.flowise/'\n```\n> and the file name is `api.json`\n\nAnd the API Keys in the UI\n\n![File Uplaod Vulnerability.](https://lh3.googleusercontent.com/d/1Y0jl8uQuzpp0EFyUzCItifiG5UW35hhV)\n\n### Impact\nThis vulnerability could potentially lead to\n* Remote Code Execution\n* Server Takeover\n* Data Theft\nAnd more","state":0,"publishedAt":"2025-03-13T22:38:03+00:00","modifiedAt":"2026-07-08T07:35:41.1316925+00:00","affected":[{"ecosystem":"npm","name":"flowise","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"2.2.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g","https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7","https://github.com/FlowiseAI/Flowise"],"sourceUrl":"https://github.com/advisories/GHSA-h42x-xx2q-6v6g","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-h42x-xx2q-6v6g","identifiers":["GHSA-h42x-xx2q-6v6g","CVE-2025-71333"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T09:21:39.5670180+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T09:21:39.567018+00:00","lastSuccessAt":"2026-11-10T09:21:39.7230126+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.7230148+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T09:21:38.2251552+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:38.2251552+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T09:22:06.7603645+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T09:21:39.5670180+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T09:21:39.567018+00:00","lastSuccessAt":"2026-11-10T09:21:39.7239823+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.7239826+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-31ba7927d759462ab5120f3eef3ca629","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T09:22:06.1277445+00:00","lastSuccessAt":"2026-11-10T09:22:06.124+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T09:22:06.124+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T09:21:39.3678777+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.3678777+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T09:21:39.1274719+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.1274719+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T09:21:39.5260038+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.5260038+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T09:21:39.251251+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.251251+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}