EXPOSURES › CVE-2025-71333
CVE-2025-71333
CRITICAL
DETAIL
SourceNVD · cve
Published2026-06-25
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2025-71333 ↗
⚡ RCE
◐ ZERO-DAY
SHAME 50/100
rcezero-day
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary director
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
PLAYERS IMPLICATED
DESCRIPTION
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.
AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.