Executive brief
FlowiseAI Flowise is a low-code platform for building AI agents and workflows. The application contains an arbitrary file upload vulnerability in its attachment API endpoint that allows unauthenticated attackers to upload malicious files, potentially leading to remote code execution or application compromise.
Technical details
The vulnerability is an arbitrary file upload flaw (CWE-434) located in the `/api/v1/attachments` endpoint of Flowise v2.2.6. The endpoint fails to properly validate or restrict uploaded file types, allowing an attacker to upload arbitrary files without authentication. By uploading executable or script files, an attacker can achieve remote code execution on the server hosting the application. The vulnerability requires network access but no authentication or user interaction.
Affected products
- FlowiseAI Flowise through 2.2.6
Timeline
- 2025-03-05: disclosed
- 2025-03-04: other: NVD published CVE-2025-26319