Flowise
CVE-2025-26319
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 77.0%, PoC available. This is the third Flowise vulnerability in the high-EPSS list, confirming the platform as a high-risk AI tool. Flowise's rapid adoption and frequent security issues make it a priority target. Instances often contain API keys worth thousands of dollars in usage credits. |
| Exploit ScenarioDerived | An attacker uploads a Node.js script to /api/v1/attachments that, when processed by Flowise's flow engine, executes a reverse shell. Alternatively, they upload a file that overwrites an existing flow definition to include malicious code. The attacker gains server access and extracts all configured LLM API keys, vector database credentials, and uploaded documents. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Unauthenticated attackers can upload malicious files including executable scripts, achieving remote code execution on the Flowise server.
Earlier versions of this analysis (1)
Arbitrary file upload in FlowiseAI Flowise via unauthenticated /api/v1/attachments endpoint enables RCE through webshell deployment.
RemediationAI
Update Flowise to the latest version. Implement authentication on all API endpoints. Configure strict file type allowlisting on upload endpoints. Run Flowise in a sandboxed container with minimal privileges. Monitor the attachments directory for unexpected file types.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The /api/v1/attachments API endpoint allows file uploads without authentication or file type validation. An attacker can upload a .js, .py, or other executable file type. Depending on the server configuration and how uploaded files are served, this can lead to server-side code execution. Even without direct execution, uploaded files can overwrite application files or be used for phishing.
Know when Flowise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.
Executive ViewAI
Organizations using FlowiseAI Flowise v2.2.6 face critical risk from CVE-2025-26319, a unrestricted file upload vulnerability rated CVSS 9.8. This could allow attackers to access or modify files outside intended directories, potentially exposing sensitive configuration or credentials. With an EPSS score of 77%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict file upload functionality via WAF; (2) Implement allowlist-based file type validation; (3) Use chroot/containerization to limit filesystem access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Affected Products (CPE)CVE.org
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flo
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage o
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Exploit-DB