Vulnerability · Published Apr 23, 2026 · Assigned by GitHub_M

CVE-2026-41269Flowise: File Upload Validation Bypass in createAttachment

High 7.1

In plain English

A high-severity unrestricted file upload in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.5%top 59.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally allow JavaScript uploads. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). This vulnerability is fixed in 3.1.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	3.1.0	GHSA-rh7v-6w34-w2rr

Affected products (as reported)

Vendor	Product	Versions
FlowiseAI	Flowise	< 3.1.0

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rh7v-6w34-w2rr x_refsource_CONFIRM