AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

FlowiseGHSA-69jq-qr7w-j7qh

FlowiseAI Flowise arbitrary file upload vulnerability

Flowise

CVE-2025-26319 · Published Mar 5, 2025

High
No fix yet
GitHub advisory

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

Affected versions

PackageAffectedFixed in
flowise
npm
<= 2.2.6No fix yet
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Severity from
GitHub (reviewed advisory)
Weakness
CWE-434
Also known as
CVE-2025-26319

More Flowise advisories

All Flowise
Critical 9.8Aug 14, 2025Flowise OS command remote code executionCVE-2025-8943no fix yetHigh 5.9Apr 7, 2025FlowiseDB vulnerable to SQL Injection by authenticated usersCVE-2025-71332no fix yetCritical 10.0Mar 14, 2025Flowise allows arbitrary file write to RCECVE-2025-71338no fix yetCriticalMar 13, 2025Flowise Pre-auth Arbitrary File UploadCVE-2025-71333no fix yetHighNov 21, 2024Flowise OverrideConfig security vulnerabilityCVE-2024-58351fixed in 2.1.4Medium 9.6Sep 25, 2024Flowise and Flowise Chat Embed vulnerable to Stored Cross-site ScriptingCVE-2024-9148fixed in 2.1.1