CVE-2025-71333

Katalog CVE

CVSS 9.8 · Critical EPSS 0,90%

Kerentanan External Control of File Name or Path pada flowiseai flowise. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g advisory vendor · exploit
• https://www.vulncheck.com/advisories/flowise-arbitrary-file-upload-via-unauthenticated-api-v1-attachments-endp... advisory pihak ketiga