Skip to content
OpenAdvisories
Critical WID-SEC-2025-0568 2 CVEs

Flowise: Schwachstelle ermöglicht Codeausführung

Published Mar 13, 2025 · Updated Jun 25, 2026 · Revision 3 · de-DE

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Flowise ausnutzen, um beliebigen Programmcode auszuführen.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 2

  • Critical 9.8
    CVE-2025-26319 Public exploit Scanner template EPSS 56%

    FlowiseAI Flowise arbitrary file upload vulnerability

    FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

    flowise npm
  • Critical 9.3
    CVE-2025-71333

    Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint

    Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files …

    Flowise Flowise flowise npm

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2025-71333, EUVD-2025-210339

  2. #2

    Referenz(en) aufgenommen: EUVD-2025-34455

  3. #1

    Initiale Fassung

References