Critical
Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
Type: advisorySources: OSV
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-71333
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 01:49 UTC · Revision 1
Source evidence
Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
core-osv · Original sourcePublished 25 Jun 2026, 21:41 UTC
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.
osv:CVE-2025-71333
Complete source record
{
"id": "a25d3cd6f96d4b3c7c89640e65ca704cb13c43780b90b7ec2eda9c8cda141834",
"url": "https://osv.dev/vulnerability/CVE-2025-71333",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint",
"summary": "Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.",
"evidence": "osv:CVE-2025-71333",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2025-71333",
"aliases": [
"CVE-2025-71333",
"GHSA-h42x-xx2q-6v6g"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/flowiseai/flowise",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "ef96b57303c1ffe2c04340ebe97759fe20ecc649"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.2.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"cpe": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.2.4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"flowise@2.2.4",
"flowise-ui@2.2.4",
"flowise-components@2.2.4",
"flowise@2.2.3",
"flowise-ui@2.2.3",
"flowise-components@2.2.3",
"flowise@2.2.2",
"flowise-ui@2.2.2",
"flowise-components@2.2.2",
"flowise@2.2.1",
"flowise-ui@2.2.1",
"flowise-components@2.2.1",
"flowise@2.2.0",
"flowise-ui@2.2.0",
"flowise-components@2.2.0",
"flowise@2.1.5",
"flowise-ui@2.1.5",
"flowise-components@2.1.5",
"flowise@2.1.4",
"flowise-ui@2.1.4",
"flowise-components@2.1.4",
"flowise@2.1.3",
"flowise-ui@2.1.3",
"flowise-components@2.1.3",
"flowise@2.1.2",
"flowise-ui@2.1.2",
"flowise-components@2.1.2",
"flowise@2.1.1",
"flowise-ui@2.1.1",
"flowise-components@2.1.1",
"flowise@2.1.0",
"flowise-ui@2.1.0",
"flowise-components@2.1.0",
"flowise@2.0.7",
"flowise-ui@2.0.7",
"flowise-components@2.0.7",
"flowise@2.0.6",
"flowise-ui@2.0.6",
"flowise-components@2.0.6",
"flowise@2.0.5",
"flowise-ui@2.0.5",
"flowise-components@2.0.5",
"flowise@2.0.4",
"flowise-ui@2.0.4",
"flowise-components@2.0.4",
"flowise@2.0.3",
"flowise-ui@2.0.3",
"flowise-components@2.0.3",
"flowise@2.0.2",
"flowise-ui@2.0.2",
"flowise-components@2.0.2",
"flowise@1.8.4",
"flowise-ui@1.8.4",
"flowise-components@1.8.6",
"flowise@1.8.3",
"flowise-ui@1.8.3",
"flowise-components@1.8.4",
"flowise@1.8.2",
"flowise-ui@1.8.2",
"flowise-components@1.8.3",
"flowise@1.8.1",
"flowise-ui@1.8.1",
"flowise-components@1.8.1",
"flowise@1.8.0",
"flowise-ui@1.8.0",
"flowise-components@1.8.0",
"flowise@1.7.2",
"flowise-ui@1.7.2",
"flowise-components@1.7.2",
"flowise@1.7.1",
"flowise-ui@1.7.1",
"flowise-components@1.7.1",
"flowise@1.7.0",
"flowise-ui@1.7.0",
"flowise-components@1.7.0",
"flowise@1.6.6",
"flowise-ui@1.6.6",
"flowise-components@1.6.8",
"flowise@1.6.5",
"flowise-ui@1.6.5",
"flowise-components@1.6.7",
"flowise@1.6.4",
"flowise-ui@1.6.4",
"flowise-components@1.6.6",
"flowise@1.6.3",
"flowise-ui@1.6.3",
"flowise-components@1.6.5",
"flowise@1.6.2",
"flowise-ui@1.6.2",
"flowise-components@1.6.4",
"flowise@1.6.1",
"flowise-ui@1.6.1",
"flowise-components@1.6.3",
"flowise@1.6.0",
"flowise-ui@1.6.0",
"flowise-components@1.6.2",
"flowise@1.5.1",
"flowise-ui@1.5.1",
"flowise-components@1.6.1",
"flowise@1.5.0",
"flowise-ui@1.5.0",
"flowise-components@1.6.0",
"flowise@1.4.12",
"flowise-ui@1.4.9",
"flowise-components@1.5.3",
"flowise@1.4.11",
"flowise-ui@1.4.8",
"flowise-components@1.5.2",
"flowise@1.4.10",
"flowise-ui@1.4.7",
"flowise-components@1.5.1",
"flowise@1.4.9",
"flowise@1.4.8",
"flowise-ui@1.4.6",
"flowise-components@1.5.0",
"flowise@1.4.7",
"flowise-ui@1.4.5",
"flowise-components@1.4.9",
"flowise-components@1.4.8",
"flowise@1.4.6",
"flowise-ui@1.4.4",
"flowise-components@1.4.7",
"flowise@1.4.5",
"flowise-ui@1.4.3",
"flowise@1.4.4",
"flowise-ui@1.4.2",
"flowise-components@1.4.6",
"flowise@1.4.2",
"flowise-components@1.4.2",
"flowise@1.4.1",
"flowise-components@1.4.1",
"flowise@1.4.0",
"flowise-ui@1.4.0",
"flowise-components@1.4.0",
"flowise@1.3.9",
"flowise-ui@1.3.7",
"flowise-components@1.3.11",
"flowise-components@1.3.10",
"flowise@1.3.8",
"flowise-ui@1.3.6",
"flowise-components@1.3.9",
"flowise@1.3.7",
"flowise-ui@1.3.5",
"flowise-components@1.3.8",
"flowise@1.3.6",
"flowise-ui@1.3.4",
"flowise-components@1.3.7",
"flowise@1.3.5",
"flowise-ui@1.3.3",
"flowise-components@1.3.5",
"flowise@1.3.4",
"flowise-ui@1.3.2",
"flowise-components@1.3.4",
"flowise@1.3.3",
"flowise-ui@1.3.1",
"flowise-components@1.3.3",
"flowise@1.3.2",
"flowise-components@1.3.2",
"flowise@1.3.1",
"flowise-components@1.3.1",
"flowise@1.3.0",
"flowise-ui@1.3.0",
"flowise-components@1.3.0",
"flowise@1.2.16",
"flowise-ui@1.2.15",
"flowise-components@1.2.17",
"flowise@1.2.15",
"flowise-ui@1.2.14",
"flowise-components@1.2.16",
"flowise@1.2.14",
"flowise-ui@1.2.13",
"flowise-components@1.2.15",
"flowise@1.2.13",
"flowise-ui@1.2.12",
"flowise-components@1.2.14",
"flowise@1.2.11",
"flowise-ui@1.2.10",
"flowise-components@1.2.12",
"flowise@1.2.9",
"flowise-components@1.2.10",
"flowise@1.2.8",
"flowise-ui@1.2.7",
"flowise-components@1.2.9",
"flowise@1.2.7",
"flowise-ui@1.2.6",
"flowise-components@1.2.8",
"flowise@1.2.6",
"flowise-ui@1.2.5",
"flowise-components@1.2.7",
"flowise@1.2.5",
"flowise-ui@1.2.4",
"flowise-components@1.2.6",
"flowise@1.2.4",
"flowise-ui@1.2.3",
"flowise-components@1.2.5",
"flowise@1.2.3",
"flowise-ui@1.2.2",
"flowise-components@1.2.4",
"flowise-components@1.2.3",
"flowise@1.2.2",
"flowise-ui@1.2.1",
"flowise-components@1.2.2",
"flowise@1.2.1",
"flowise-ui@1.2.0",
"flowise-components@1.2.1",
"flowise@1.1.1",
"flowise-components@1.1.1",
"flowise@1.1.0",
"flowise-ui@1.1.0",
"flowise-components@1.1.0",
"flowise@1.0.1",
"flowise@1.0.0",
"flowise-ui@1.0.0",
"flowise-components@1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71333.json"
}
}
],
"modified": "2026-10-28T02:30:32.297400229Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71333.json",
"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g",
"https://nvd.nist.gov/vuln/detail/CVE-2025-71333",
"https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endpoint"
],
"provider_metadata": {
"cwe_ids": [
"CWE-73"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71333.json"
}
},
"related_cves": [
{
"value": "CVE-2025-71333",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499495,
"published_at": "2026-06-25T21:41:04.896+00:00"
}