Arbitrary File Upload Vulnerability in FlowiseAI Flowise

# Arbitrary File Upload Vulnerability in FlowiseAI Flowise

https://gcdradar.vercel.app/incidents/arbitrary-file-upload-vulnerability-in-flowiseai-flowise · AIR-2025-0004 · closed 2025-03-04

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-03-04
- AI role: Attack on AI
- Products: FlowiseAI Flowise
- CVE ids: CVE-2025-26319
- CVSS: 8.9

## Summary

An arbitrary file upload vulnerability was discovered in FlowiseAI Flowise v2.2.6 within the attachments API endpoint. The vulnerability carries a critical CVSS score, though no active exploitation has been confirmed.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-03-05: CVE-2025-26319: FlowiseAI Flowise arbitrary file upload vulnerability (https://github.com/advisories/GHSA-69jq-qr7w-j7qh)
- 2025-03-04: CVE-2025-26319: FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. (https://nvd.nist.gov/vuln/detail/CVE-2025-26319)

## Sources

- 2025-03-04 NVD: CVE-2025-26319: FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. https://nvd.nist.gov/vuln/detail/CVE-2025-26319
- 2025-03-05 GitHub Advisory Database: CVE-2025-26319: FlowiseAI Flowise arbitrary file upload vulnerability https://github.com/advisories/GHSA-69jq-qr7w-j7qh

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.