Arbitrary file upload in Flowiseai Flowise
CVE-2025-61687
Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables…
Vulnerability class: Unrestricted File Upload
EPSS: 0.004 (58.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H.
Affected products
- Flowiseai Flowise — versions = 3.0.7
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-35g6-rrw3-v6xc (x_refsource_CONFIRM)
- https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L1104-L1111 (x_refsource_MISC)
- https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L170-L175 (x_refsource_MISC)
- https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L533-L541 (x_refsource_MISC)
- https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/controllers/attachments/index.ts#L4-L11 (x_refsource_MISC)
- https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/routes/attachments/index.ts#L8 (x_refsource_MISC)
- https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/services/attachments/index.ts#L7-L16 (x_refsource_MISC)
- https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/utils/createAttachment.ts#L118-L126 (x_refsource_MISC)
- https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/utils/index.ts#L1950-L1954 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-61687?
- CVE-2025-61687 is a high-severity vulnerability in Flowiseai Flowise, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.3/10. Published 2025-10-06.
- How severe is CVE-2025-61687?
- High severity. CVSS v3 base score is 8.3 out of 10.
- Is CVE-2025-61687 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.