CVE-2026-30821: 
Flowise vulnerability analysis and mitigation

CVE-2026-30821 is an arbitrary file upload vulnerability via MIME spoofing in FlowiseAI's Flowise, an open-source low-code AI chatflow builder. The flaw affects all Flowise versions up to and including 3.0.12, and was disclosed on March 5, 2026, with a patch released in version 3.0.13. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.2 (High) (Github Advisory, Flowise Advisory).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The /api/v1/attachments/:chatflowId/:chatId endpoint is included in WHITELIST_URLS, bypassing JWT authentication entirely. The server validates uploads by checking the client-supplied Content-Type header (file.mimetype) against an allowlist, but never verifies the file's actual content (magic bytes) or its extension (file.originalname). An attacker can therefore spoof the Content-Type as a permitted type (e.g., application/pdf) while uploading a malicious file (e.g., shell.js or shell.php), which is then persisted to backend storage (local disk, S3, or GCS) via addArrayFilesToStorage without further inspection (Github Advisory, Flowise Advisory).

Successful exploitation enables two primary attack paths: server-side Remote Code Execution (RCE) by uploading and triggering a web shell, granting full system privileges and unauthorized access to internal data; and client-side Stored XSS by uploading malicious HTML or SVG files that execute in victims' browsers, enabling session cookie theft and account takeover. The risk is amplified in deployments using shared cloud storage (S3, GCS) or static file hosting, where a compromise could propagate across the entire infrastructure and affect multiple tenants (Github Advisory).

A public proof-of-concept (PoC) exploit is available in the official security advisory, consisting of a concrete curl command that demonstrates the MIME spoofing attack against the unauthenticated endpoint. No authentication, session, or API key is required to exploit this vulnerability. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.12–0.27%, and the vulnerability is not currently listed in the CISA KEV catalog (Flowise Advisory).

1. Reconnaissance: Identify internet-facing Flowise instances (versions ≤ 3.0.12) using tools like Shodan or Censys, searching for the Flowise web interface or API endpoints on default port 3000.
2. Identify a valid chatflowId: Query the public endpoint /api/v1/public-chatflows (also whitelisted and unauthenticated) to enumerate valid chatflowId UUIDs.
3. Prepare the malicious payload: Create a file with a dangerous extension and content, such as shell.js containing a Node.js reverse shell or shell.php with a web shell payload.
4. Spoof the MIME type and upload: Send a multipart POST request to /api/v1/attachments/<chatflowId>/<any-uuid>, setting the file's Content-Type to an allowed type (e.g., application/pdf) while retaining the malicious filename:

   curl -X POST \
     "http://<target>:3000/api/v1/attachments/891f64a2-a26f-4169-b333-905dc96c200a/$(uuidgen)" \
     -F "files=@shell.js;type=application/pdf"

5. Trigger execution or serve the file: If the Flowise instance has static file hosting or a file retrieval endpoint enabled, request the uploaded file to trigger server-side execution (RCE) or serve it to a victim's browser (Stored XSS) (Flowise Advisory).

• Network: Unauthenticated HTTP POST requests to /api/v1/attachments/<uuid>/<uuid> from external or unexpected IP addresses; outbound connections from the Flowise server process to unknown external hosts (potential reverse shell).
• Logs: Web server access logs showing POST requests to /api/v1/attachments/ with multipart form data and Content-Type: application/pdf (or other allowed types) but filenames ending in .js, .php, .html, or .svg; HTTP 200 responses to these requests indicating successful upload.
• File System: Unexpected files with executable extensions (.js, .php, .html, .svg) in the Flowise uploads directory (~/.flowise/uploads/ or the configured BLOB_STORAGE_PATH); newly created files with UUID-based names that do not match expected image or document content.
• Process: Unusual child processes spawned by the Flowise Node.js process (e.g., bash, sh, curl, wget, python); unexpected network listeners or connections initiated by the Flowise service account (Flowise Advisory).

Upgrade Flowise to version 3.0.13 or later, which adds MIME type and file extension validation for uploads (PR #5596: "Add MIME type and extension validation for file uploads"). As a temporary workaround, administrators can add /api/v1/attachments to the DENYLIST_URLS environment variable to remove it from the whitelist and require authentication, though this will disable unauthenticated file upload functionality. Additionally, restrict execution permissions on the uploads directory and implement strict access controls on shared storage (S3, GCS) to limit the blast radius of any successful upload (Flowise Release, Github Advisory).

The vulnerability was reported by security researcher im-soohyun and published by igor-magun-wd to the FlowiseAI repository on March 5, 2026. Check Point Research published an advisory (CPAI-2026-4534) covering this vulnerability. The CVE was picked up by multiple vulnerability tracking services including CIRCL, CVEFeed, and INCIBE-CERT shortly after disclosure. Social media activity was noted on Bluesky via the CVE tracking account (Flowise Advisory).