CVE-2025-26319

Impact

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

Affected packages

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• GitHub advisory
• https://github.com/dorattias/CVE-2025-26319
• https://github.com/advisories/GHSA-69jq-qr7w-j7qh
• https://nvd.nist.gov/vuln/detail/CVE-2025-26319
• https://github.com/FlowiseAI/Flowise/blob/flowise-ui%402.2.6/packages/server/src/index.ts#L165-L190