CVE-2025-71333

The /api/v1/attachments endpoint does not require authentication and accepts files uploaded by users. The chatId and chatflowId parameters are vulnerable to path traversal (CWE-73 – External Control of File Name or Path), which allows an attacker to manipulate the target file save path. As a result, a malicious file can be saved outside the intended directory – in any location accessible to the application process. This vulnerability only affects configurations where the storageType parameter is set to local.

An attacker can upload malicious files (e.g., webshell) to arbitrary directories on the server, which can lead to remote code execution (RCE) and complete takeover of the server.

Patches available from the vendor should be applied according to the references. As an interim measure, consider changing the storageType configuration to a value other than local (e.g., external file storage) and restricting network access to the /api/v1/attachments endpoint using a firewall or infrastructure-level authentication mechanisms.

Flowise in versions up to and including 2.2.4, configured with the storageType parameter set to local.