Flowise Arbitrary File Upload Vulnerability CVE-2025-71333

# Flowise Arbitrary File Upload Vulnerability CVE-2025-71333

https://gcdradar.vercel.app/incidents/flowise-arbitrary-file-upload-vulnerability-cve-2025-71333 · AIR-2026-0033 · closed 2026-06-25

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: No patch yet
- First reported: 2026-06-25
- AI role: Attack on AI
- Products: Flowise
- CVE ids: CVE-2025-71333
- CVSS: 9.8

## Summary

Flowise contains an unauthenticated arbitrary file upload vulnerability via path traversal parameters, allowing remote attackers to achieve remote code execution. A security advisory and CVE were published with no active exploitation confirmed.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Affected and fixed versions

- Affected: flowise <= 2.2.7

## Latest updates

- 2026-06-26: GitHub advisory published (https://github.com/advisories/GHSA-c3hj-m5hq-59xw)
- 2026-06-25: CVE-2025-71333: Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when… (https://nvd.nist.gov/vuln/detail/CVE-2025-71333)

## Sources

- 2026-06-25 NVD: CVE-2025-71333: Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when… https://nvd.nist.gov/vuln/detail/CVE-2025-71333
- 2026-06-26 GitHub Advisory Database: GHSA-c3hj-m5hq-59xw: Duplicate Advisory : Flowise allows arbitrary file write to RCE https://github.com/advisories/GHSA-c3hj-m5hq-59xw

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.