CVE-2025-26319

Description

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

How to fix CVE-2025-26319

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• npm/flowise—no fix listed

Is CVE-2025-26319 being exploited?

Likely — EPSS is 87.7%, placing CVE-2025-26319 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (1)

• from 0, <= 2.2.6

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-26319
• PATCHgithub.com/FlowiseAI/Flowise
• WEBgithub.com/dorattias/CVE-2025-26319
• WEBgithub.com/FlowiseAI/Flowise/blob/flowise-ui%402.2.6/packages/server/src/index.ts#L165-L190