CVE-2026-41269 - Flowise: File Upload Validation Bypass in createAttachment

Back Back to CVE browser

HIGH

Flowise: File Upload Validation Bypass in createAttachment

Published Apr 23, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.69%

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally allow JavaScript uploads. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). This vulnerability is fixed in 3.1.0.

Affected products

Vendor FlowiseAI Product Flowise Default
n/a
- Version
  < 3.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FlowiseAI

Flowise

n/a

Version	Status	Constraints
< 3.1.0	affected	-

Ecosystem	Package	Introduced	Fixed
npm	flowise	0	3.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (3)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rh7v-6w34-w2rr
exploitx_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-rh7v-6w34-w2rr
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41269

Link	Providers	Tags
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rh7v-6w34-w2rr		exploitx_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-rh7v-6w34-w2rr		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41269