What is the CVSS score of CVE-2025-61687?

CVE-2025-61687 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 11.1%.

Which versions of Flowise are affected by CVE-2025-61687?

Flowise 3.0.7, an open-source low-code LLM application builder used across the organization, permits authenticated users to upload arbitrary files, which can be stored as Node.js web shells and later…. A patch is available.

Is there a public PoC exploit available for CVE-2025-61687?

Yes, a public proof-of-concept exploit is available for CVE-2025-61687. Prioritise patching immediately. EPSS: 11.1%.

How to fix or mitigate CVE-2025-61687?

Within 24 hours, inventory every Flowise 3.0.7 instance, confirm which are internet-facing, and restrict access to trusted networks or VPN-only; temporarily disable or tightly restrict the file-upload functionality for non-administrator accounts and review the last 30 days of upload activity and the Flowise upload/storage directories for unexpected .js, .json, or shell-like files. Within 7 days, enforce least privilege by removing low-privilege and dormant accounts, require MFA on all Flowise logins, place instances behind a web application firewall with rules blocking executable file types and anomalous upload paths, enable verbose logging and alerting on file writes and unexpected Node.js child processes, and subscribe to the Flowise GitHub repository and vendor channels for the release of a fixed version. Within 30 days, upgrade to the first vendor-released patched version of Flowise as soon as it is published (there is no vendor-released patch identified at time of analysis, so do not assume 3.0.7 or any current build is remediated), migrate or rebuild any instance showing signs of compromise from a clean image, and formalize a recurring review of AI-platform components - including Flowise - into the vulnerability management program with defined patch SLAs.

Flowise CVE-2025-61687

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-10-06 security-advisories@github.com

RCE Node.js File Upload Flowise Flowiseai

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable upload needs only a low-privilege account (PR:L) and no validation bypass (AC:L); I retain C/I/A:H because a stored web shell, once triggered, yields full host compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 30, 2026 - 16:55 vuln.today

CVE Published

Oct 06, 2025 - 16:15 nvd

HIGH 8.8

DescriptionNVD

Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). The system fails to validate file extensions, MIME types, or file content during uploads. As a result, malicious scripts such as Node.js-based web shells can be uploaded and stored persistently on the server. These shells expose HTTP endpoints capable of executing arbitrary commands if triggered. The uploaded shell does not automatically execute, but its presence allows future exploitation via administrator error or chained vulnerabilities. This presents a high-severity threat to system integrity and confidentiality. As of time of publication, no known patched versions are available.

AnalysisAI

Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage of Node.js web shells that can lead to remote code execution if triggered. The vulnerability requires low-privilege authentication (PR:L) and has a CVSS score of 8.8; publicly available exploit code exists. While the uploaded shells do not auto-execute, they can be leveraged through administrator error or chained vulnerabilities, posing a high threat to system integrity and confidentiality.

Technical ContextAI

Flowise is a Node.js-based drag-and-drop interface for building LLM flows. The vulnerability resides in the attachment upload functionality, specifically in the POST route handled by Multer, which fails to validate file extensions, MIME types, or content (CWE-434). The taint flow spans route registration, controller, service layer, and file storage utilities, allowing uploads of arbitrary files such as Node.js web shells. These shells expose HTTP endpoints for command execution if triggered. The affected component is identified by CPE cpe:2.3:a:flowiseai:flowise:3.0.7. The root cause is the absence of proper file type and content checks, enabling persistent storage of malicious scripts.

RemediationAI

Upgrade to Flowise version 3.0.8, which contains the vendor-released patch. The advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-35g6-rrw3-v6xc provides further guidance. If upgrading is not immediately possible, restrict access to the attachments/file-upload feature to trusted users only, as the vulnerability requires authentication. Additionally, configure the web server to prevent execution of uploaded files in the upload directory (e.g., disable script execution for that path) and regularly scan for and remove suspicious uploaded files. Note that these workarounds may impact legitimate file upload functionality and require careful configuration.