CVE-2025-71333: Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 2.2.4 - Configuration
If using the /api/v1/attachments endpoint, do not set storageType to "local" (vulnerability applies when storageType is set to local).
Flowise (/api/v1/attachments) storageType = local - Compensating control
Ensure the /api/v1/attachments endpoint is not reachable without authentication (it is described as unauthenticated in /api/v1/attachments), e.g., restrict access at the network layer or via an upstream auth/WAF so unauthenticated clients cannot call it.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71333?
CVE-2025-71333 has a critical severity rating of 9.3.
How do I fix CVE-2025-71333?
To fix CVE-2025-71333, ensure that the /api/v1/attachments endpoint requires authentication and validate the file types and paths.
What systems are affected by CVE-2025-71333?
CVE-2025-71333 affects Flowise versions up to and including 2.2.4.
What type of vulnerability is CVE-2025-71333?
CVE-2025-71333 is an arbitrary file upload vulnerability caused by a path traversal issue.
Can remote attackers exploit CVE-2025-71333?
Yes, remote attackers can exploit CVE-2025-71333 to upload malicious files if they access the vulnerable endpoint.