FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.
Historical advisory saved 31 Oct 2026 23:10:42 UTC. The publisher may have updated it since then. Latest advisory.
euvd · EUVD-2025-6168
PublishedFlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Mar 4, 2025, 12:00:00 AM
dateUpdated: Mar 5, 2025, 4:45:28 PM
1 related source bulletins · separate from aliases
WID-SEC-W-2025-0568: Flowise: Schwachstelle ermöglicht Codeausführung
CVE-2025-26319
- Source published
- Mar 4, 2025, 12:00:00 AM (timezone not stated)
- Source modified
- Mar 5, 2025, 4:45:28 PM (timezone not stated)
- Saved here
- 31 Oct 2026 23:10:42 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 3.1 · 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H