# CVE-2024-8182: Flowise unauthenticated denial of service in file upload endpoint

Source: https://junglewise.ai/threats/cve-2024-8182-flowise-unauthenticated-denial-of-service-in-file-upload-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-8182 · Severity: low · CVSS 3.1 · Published 2024-08-27

Flowise is a visual AI agent builder used to create and deploy intelligent automation workflows. An unauthenticated attacker can crash the entire Flowise instance by sending a specially crafted request to the file upload API endpoint, rendering the service unavailable to all users and disrupting business operations that depend on the platform.

Technologies: [flowise (npm)](https://junglewise.ai/threats/technologies/flowise). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-8182 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-8182 being exploited in the wild.

**How severe is CVE-2024-8182?** Low severity, with a CVSS score of 3.1, published 27 August 2024.

**Which products and versions are affected?** flowise (npm) SEMVER:introduced=0,last_affected=1.8.2.

**Is there a fix for CVE-2024-8182?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-8182 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2024-8182?** Check whether you run flowise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated denial of service vulnerability exists in Flowise version 1.8.2 in the /api/v1/get-upload-file endpoint due to improper handling of user-supplied input. The vulnerability is classified as CWE-400 (uncontrolled resource consumption). An attacker can send a crafted request to this endpoint without authentication to trigger a complete crash of the Flowise instance. The attack vector is network-based with no authentication required and no user interaction needed. As of the disclosure date (August 27, 2024), Flowise maintainers had not provided a patch or mitigation strategy despite multiple contact attempts from Tenable beginning in June 2024. The repository has since been archived.

## Affected products

- Flowise Flowise 1.8.2 and all previous versions

## Identifiers

- CVE-2024-8182
- GHSA-48x4-mx8f-gr4h

## Timeline

- 2024-08-27: disclosed: Vulnerability published by Tenable; CVE-2024-8182 assigned
- 2024-06-13: other: Tenable first contacted vendor for security contact
- 2024-08-14: other: Tenable third contact attempt with vendor

## References

- [https://github.com/FlowiseAI/Flowise](https://github.com/FlowiseAI/Flowise)
- [https://tenable.com/security/research/tra-2024-34](https://tenable.com/security/research/tra-2024-34)

## Related threats

- [Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)](https://junglewise.ai/threats/duplicate-advisory-invited-users-auto-promoted-via-sso-email-match-d290aa10)
- [Duplicate Advisory: Flowise contains an unauthenticated sandbox escape](https://junglewise.ai/threats/duplicate-advisory-flowise-contains-an-unauthenticated-sandbox-escape-8959e167)
- [Flowise incomplete credential redaction in API](https://junglewise.ai/threats/cve-2026-73604-flowise-incomplete-credential-redaction-in-api)
- [Flowise text-to-speech endpoint credential abuse via unauthenticated access](https://junglewise.ai/threats/cve-2026-73603-flowise-text-to-speech-endpoint-credential-abuse-via)
- [Flowise IDOR in payment source endpoint](https://junglewise.ai/threats/cve-2026-73488-flowise-idor-in-payment-source-endpoint)