GitHub Advisoryadvisory · npm

GHSA-69jq-qr7w-j7qh FlowiseAI Flowise arbitrary file upload vulnerability

HIGH Published 2025-03-05 Modified 2025-03-05 Official page ↗

Aliases: CVE-2025-26319
Ecosystem: npm
Packages: flowise
Severity: High
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weaknesses: CWE-434
Reviewed: 2025-03-05

Affected packages

• npm flowise: <= 2.2.6 (no fix yet)

Description

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

Related

Alias · CVE (1)

CVE-2025-26319 FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. vulnerability

Weakness · CWE (1)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References