{"action":"Upgrade flowise to 3.0.8 or later.","affected":[{"fixed":"3.0.8","introduced":"3.0.7"}],"component":"flowise","cve_ids":["CVE-2025-61687"],"ecosystem":"npm","epss":0.11758,"exploited":false,"fixed_versions":["3.0.8"],"ghsa_id":"GHSA-35g6-rrw3-v6xc","id":"tcs_01M5KEW1NT7KCKGWTRVW54CPTK","modified_at":"2025-12-16T23:35:36.075852Z","published_at":"2025-10-08T19:34:21Z","references":["https://osv.dev/vulnerability/GHSA-35g6-rrw3-v6xc","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-35g6-rrw3-v6xc","https://nvd.nist.gov/vuln/detail/CVE-2025-61687","https://github.com/FlowiseAI/Flowise","https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L1104-L1111","https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L170-L175","https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/components/src/storageUtils.ts#L533-L541","https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/controllers/attachments/index.ts#L4-L11","https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/routes/attachments/index.ts#L8","https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/services/attachments/index.ts#L7-L16","https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/utils/createAttachment.ts#L118-L126","https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/utils/index.ts#L1950-L1954"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-35g6-rrw3-v6xc","url":"https://osv.dev/vulnerability/GHSA-35g6-rrw3-v6xc"}],"summary":"FlowiseAI/Flosise has File Upload vulnerability"}