CVE-2026-91934CWE-22path-traversal

CVE-2026-91934

High · published September 15, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00737 · 54.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-15T20:17Z
References (2)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-pwfj-wh95-7mwp · [email protected]https://www.vulncheck.com/advisories/flowise-before-3.1.4-remote-code-execution-via-sql-database-chain · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 15 SEP 15:17Z
    Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
    cvelistv5