CVE-2025-71333 Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint

Critical 9.3 Published 25 Jun 2026 Updated 27 Jun 2026

Attackers can upload malicious files to arbitrary directories via path traversal in the unauthenticated attachments endpoint, potentially achieving remote code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-71333?

CVE-2025-71333 is a critical vulnerability in Flowiseai Flowise, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

Weakness: CWE-73

Which versions are affected by CVE-2025-71333?

2 open source packages ship an affected version, including flowise. It affects 1 product.

Package	Affected	Fixed in
`flowise` npm	All versions to `2.2.7`	None
`flowise` npm	All versions to `2.2.7`	None

Products include Flowiseai Flowise.

How do I fix CVE-2025-71333?

No fix has been published for CVE-2025-71333 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-71333 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-71333 exists.

All Flowiseai Flowise vulnerabilities

Sources

Also known as GHSA-grch-cc26-w2fv, GHSA-h42x-xx2q-6v6g.