CVE-2025-61687: Flowiseai Flowise RCE Vulnerability

CVE-2025-61687 Overview

CVE-2025-61687 is an arbitrary file upload vulnerability in FlowiseAI Flowise version 3.0.7, a drag-and-drop interface for building large language model (LLM) workflows. The flaw allows authenticated users to upload files without validation of extensions, MIME types, or content. Attackers can persist malicious Node.js web shells on the server, creating conditions for Remote Code Execution (RCE). The uploaded payload does not execute automatically, but its presence enables exploitation through administrator error or chained vulnerabilities. The weakness is tracked as [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated attackers can upload Node.js web shells that, once triggered, execute arbitrary commands and compromise the confidentiality, integrity, and availability of the Flowise host.

Affected Products

FlowiseAI Flowise version 3.0.7
Deployments using the attachments upload endpoint in packages/server/src/routes/attachments
Self-hosted Flowise instances exposing authenticated upload functionality to network users

Discovery Timeline

2025-10-06 - CVE-2025-61687 published to the National Vulnerability Database (NVD)
2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-61687

Vulnerability Analysis

The vulnerability resides in the Flowise attachments handling pipeline. The route defined in packages/server/src/routes/attachments/index.ts accepts multipart uploads and passes the file to controller and service layers without validating file metadata or content. The helper logic in packages/components/src/storageUtils.ts and packages/server/src/utils/createAttachment.ts writes the file directly to persistent storage using the client-supplied filename.

An authenticated user can therefore upload a .js file containing a Node.js HTTP server with child_process.exec handlers. The file becomes a dormant web shell stored on the host filesystem. If an administrator later runs the file, if a path traversal or deserialization issue elsewhere triggers it, or if the storage path is exposed by another component, the payload executes with the privileges of the Flowise process.

Root Cause

The Flowise attachment upload code path performs no allow-list checks on file extensions, no MIME-type verification, and no content inspection. Filenames supplied by the client are honored, and the storage routine in storageUtils.ts writes the bytes verbatim. This is a textbook instance of CWE-434, where the application trusts user-controlled file properties.

Attack Vector

Exploitation requires network access and a valid low-privileged Flowise account. The attacker authenticates, issues a POST request to the attachments endpoint with a crafted Node.js script as the upload body, and receives a stored file path in response. The shell remains inert until a secondary event invokes it, such as an operator executing node against the file, a misconfigured static route serving it, or a chained vulnerability that includes or imports it.

No verified exploit code is currently published. Refer to the GitHub Security Advisory GHSA-35g6-rrw3-v6xc for vendor-confirmed technical details and to the Flowise createAttachment utility source for the affected code path.

Detection Methods for CVE-2025-61687

Indicators of Compromise

Files with executable script extensions such as .js, .mjs, .ts, .sh, or .php written under the Flowise attachments storage directory.
HTTP POST requests to /api/v1/attachments carrying non-document MIME types or filenames with double extensions like report.pdf.js.
Outbound connections or child_process invocations originating from the Flowise Node.js process to unfamiliar hosts.
New listener sockets opened by the Flowise process on ports not used by the application.

Detection Strategies

Inspect the attachments storage directory for files whose content type does not match expected document, image, or text formats.
Enable verbose request logging on the Flowise API gateway and alert on upload requests where the Content-Type or filename extension is outside an allow-list.
Apply file integrity monitoring to the Flowise data directory and alert on creation of script files.
Correlate authenticated user sessions with upload volume to identify accounts deviating from baseline behavior.

Monitoring Recommendations

Forward Flowise application logs and host process telemetry to a centralized SIEM or data lake for retention and correlation.
Monitor the Flowise process tree for unexpected child processes such as sh, bash, cmd.exe, powershell.exe, or node spawning from the attachments directory.
Alert on egress network connections initiated by the Flowise service to addresses outside its documented dependencies.

How to Mitigate CVE-2025-61687

Immediate Actions Required

Restrict access to the Flowise management interface to trusted networks using a reverse proxy, VPN, or firewall rule until a vendor patch is released.
Audit existing accounts and remove or rotate credentials for any user that does not require attachment upload privileges.
Inventory the attachments storage directory and quarantine any file with a script or executable extension.
Run the Flowise service under a dedicated unprivileged operating system account with no shell access.

Patch Information

As of the NVD publication date, no patched version of Flowise is available. Monitor the FlowiseAI security advisories page and the GHSA-35g6-rrw3-v6xc advisory for vendor updates and apply the fix as soon as it is released.

Workarounds

Place Flowise behind a reverse proxy that enforces an allow-list of MIME types and rejects requests carrying script extensions in Content-Disposition filenames.
Mount the attachments storage directory with the noexec flag on Linux hosts to prevent execution of files written there.
Disable the attachments feature in deployments that do not require it by removing or blocking the /api/v1/attachments route at the proxy layer.
Apply least-privilege filesystem permissions so the Flowise process cannot write to directories served by static handlers or interpreters.

bash

# Example: nginx reverse-proxy filter blocking script uploads to Flowise attachments endpoint
location /api/v1/attachments {
    if ($request_method = POST) {
        if ($http_content_type !~* "^(image/|application/pdf|text/plain)") {
            return 415;
        }
    }
    client_max_body_size 10m;
    proxy_pass http://flowise_backend;
}