npm/flowise CVE-2025-26319: critical 9.8, EPSS 55.87%
FlowiseAI Flowise arbitrary file upload vulnerability
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.2.6 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-69jq-qr7w-j7qh
- nvd: CVE-2025-26319
- https://github.com/FlowiseAI/Flowise
- https://github.com/FlowiseAI/Flowise/blob/flowise-ui%402.2.6/packages/server/src/index.ts#L165-L190
- https://github.com/dorattias/CVE-2025-26319
CVE-2025-26319 · published · modified · JSON