CVE-2026-41269CWE-434

Flowise: File Upload Validation Bypass in createAttachment

High · published April 23, 2026

CVSS v3.1
7.1
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally allow JavaScript uploads. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). This vulnerability is fixed in 3.1.0.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00692 · 52.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-04-23T19:14Z
EPSS history
Timeline
  • 23 APR 19:14Z
    Flowise: File Upload Validation Bypass in createAttachment
    cvelistv5