CVE-2025-61687

npm/flowise CVE-2025-61687: high 8.3, EPSS 10.97%

FlowiseAI/Flosise has File Upload vulnerability

Action: Upgrade flowise to 3.0.8 or later.

npm i flowise@3.0.8

Affected

Fixed versions

Sources

• osv: GHSA-35g6-rrw3-v6xc
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-35g6-rrw3-v6xc
• https://nvd.nist.gov/vuln/detail/CVE-2025-61687
• https://github.com/FlowiseAI/Flowise
• https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L1104-L1111
• https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L170-L175
• https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L533-L541
• https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/controllers/attachments/index.ts#L4-L11
• https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/routes/attachments/index.ts#L8
• https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/services/attachments/index.ts#L7-L16
• https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/utils/createAttachment.ts#L118-L126
• https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/utils/index.ts#L1950-L1954

CVE-2025-61687 · published 2025-10-08T19:34:21Z · modified 2025-12-16T23:35:36.075852Z · JSON