{"data":{"id":"983ac3e1-da0a-40f4-91bf-e13e43fecc5a","title":"CVE-2025-61687: Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in…","summary":"CVE-2025-61687 affects version 3.0.7 of FlowiseAI, a drag and drop interface for building LLM flows. Authenticated users can upload arbitrary files without validation of extensions, MIME types or content, so malicious Node.js web shells can be stored persistently on the server. The shells do not run automatically, but their presence allows later command execution through administrator error or chained vulnerabilities.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-61687","publishedAt":"2025-10-06T16:15:35.223Z","cveId":"CVE-2025-61687","cweIds":["CWE-434"],"cvssScore":"8.3","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@= 3.0.7 (fixed: 3.0.8)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise arbitrary file upload allowing persistent web shell storage","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.11758,"epssCheckedAt":"2026-11-04T12:08:34.339Z","kevDateAdded":null,"advisoryAliases":["GHSA-35g6-rrw3-v6xc"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:23.452Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-10-08T12:15:38.140Z","daysToFix":2,"fixCheckedAt":"2026-10-29T21:43:30.598Z","capecIds":["CAPEC-1"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.0.8","matchedVersion":"3.0.8","fixReleasedAt":"2025-10-08T12:15:38.140Z","daysToFix":2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:30.447Z"}]}}