Flowise versions through 2.2.4 have an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is… (CVE-2025-71333)
Flowise versions through 2.2.4 have an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. This vulnerability allows attackers to exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories. Successful exploitation could lead to remote code execution and server compromise.
AI Analysis
Technical Summary
The vulnerability in Flowise (up to version 2.2.4) involves an unauthenticated arbitrary file upload via the /api/v1/attachments endpoint when the storageType parameter is set to local. Attackers can leverage path traversal through the chatId and chatflowId parameters to place malicious files in arbitrary directories on the server. This can potentially enable remote code execution and full server compromise. The issue is categorized under CWE-73 (External Control of File Name or Path). No patch or official remediation has been provided yet, and no known exploits are reported in the wild.
Potential Impact
An attacker can upload arbitrary files without authentication, exploiting path traversal to place files in unintended directories. This can lead to remote code execution and compromise of the server hosting Flowise. The vulnerability is critical due to the unauthenticated nature and the potential for full system compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/v1/attachments endpoint and avoid using local storageType if possible. Monitor for updates from the vendor and apply patches promptly once released.
Flowise versions through 2.2.4 have an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is… (CVE-2025-71333)
Description
Flowise versions through 2.2.4 have an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. This vulnerability allows attackers to exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories. Successful exploitation could lead to remote code execution and server compromise.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Flowise (up to version 2.2.4) involves an unauthenticated arbitrary file upload via the /api/v1/attachments endpoint when the storageType parameter is set to local. Attackers can leverage path traversal through the chatId and chatflowId parameters to place malicious files in arbitrary directories on the server. This can potentially enable remote code execution and full server compromise. The issue is categorized under CWE-73 (External Control of File Name or Path). No patch or official remediation has been provided yet, and no known exploits are reported in the wild.
Potential Impact
An attacker can upload arbitrary files without authentication, exploiting path traversal to place files in unintended directories. This can lead to remote code execution and compromise of the server hosting Flowise. The vulnerability is critical due to the unauthenticated nature and the potential for full system compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/v1/attachments endpoint and avoid using local storageType if possible. Monitor for updates from the vendor and apply patches promptly once released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-grch-cc26-w2fv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-71333"]
- Ecosystems
- []
- Database Specific Severity
- CRITICAL
- Cvss Version
- 4.0
Threat ID: 6a3ef7d427e9c79719009411
Added to database: 06/26/2026, 22:06:12 UTC
Last enriched: 06/26/2026, 22:39:25 UTC
Last updated: 07/31/2026, 19:22:56 UTC
Views: 134
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.