CVE-2026-41269: 
Flowise vulnerability analysis and mitigation

CVE-2026-41269 is a file upload validation bypass vulnerability in FlowiseAI's Flowise, a drag-and-drop UI for building customized LLM flows. Prior to version 3.1.0 (affected versions ≤3.0.13), the Chatflow configuration file upload settings can be manipulated to permit the application/javascript MIME type, allowing authenticated attackers to upload malicious Node.js web shells and achieve Remote Code Execution (RCE). The vulnerability was published on April 23, 2026, and patched in version 3.1.0. It carries a CVSS v3.1 base score of 8.8 (High) per NVD, and 7.1 (High) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the Chatflow configuration API endpoint (PUT /api/v1/chatflows/{CHATFLOW_ID}) does not enforce server-side MIME type validation, allowing an authenticated low-privilege user to modify the allowedUploadFileTypes field to include application/javascript. Once this configuration change is made, the attacker can upload .js files via the POST /api/v1/attachments/{CHATFLOW_ID}/{CHAT_ID} endpoint, bypassing the frontend's restriction on JavaScript uploads. This vulnerability is a bypass of a prior related issue (GHSA-35g6-rrw3-v6xc / CVE-2025-61687). A complete Python proof-of-concept exploit and a Node.js web shell payload are publicly available in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation allows an authenticated attacker with low privileges to persistently store a malicious Node.js web shell on the server, which — if executed — grants arbitrary command execution with the privileges of the Flowise application process. This results in high impact to confidentiality, integrity, and availability, including potential data exfiltration, lateral movement within the server environment, and full system compromise. The risk is compounded if administrators inadvertently trigger the uploaded shell or if this vulnerability is chained with other weaknesses to achieve unauthenticated execution (GitHub Advisory).

A complete, functional proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a Python upload script and a Node.js web shell payload that together demonstrate end-to-end RCE against a real Flowise deployment (GitHub Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.061% (0.000610), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog at this time (Red Hat CVE).

1. Authenticate: Obtain a valid session token for a low-privilege Flowise account (e.g., via the login API), as the attack requires PR:L (low privileges required).
2. Identify target Chatflow: Enumerate available Chatflow IDs via the Flowise API (GET /api/v1/chatflows) to identify a target CHATFLOW_ID.
3. Modify Chatflow upload configuration: Send a crafted PUT /api/v1/chatflows/{CHATFLOW_ID} request with the chatbotConfig JSON body modified to include application/javascript in the allowedUploadFileTypes field, enabling .js file uploads.
4. Prepare web shell: Create a malicious shell.js Node.js file that spawns an HTTP server accepting a ?cmd= query parameter and executing arbitrary OS commands via child_process.exec().
5. Upload the web shell: Send a POST /api/v1/attachments/{CHATFLOW_ID}/{CHAT_ID} multipart request with the shell.js file and Content-Type: application/javascript, uploading the shell to the server's file system.
6. Trigger execution: Identify the stored path of the uploaded file and trigger its execution — either directly if the server processes uploaded JS files, or by chaining with another vulnerability or administrator action.
7. Achieve RCE: Access the web shell (e.g., http://<server>:8888?cmd=id) to execute arbitrary commands on the server with Flowise application privileges (GitHub Advisory).

• Network: Unexpected outbound connections from the Flowise server process on non-standard ports (e.g., 8888); HTTP requests to PUT /api/v1/chatflows/{id} with application/javascript in the allowedUploadFileTypes configuration field; POST /api/v1/attachments/ requests uploading files with Content-Type: application/javascript.
• File System: Presence of unexpected .js files in Flowise attachment or upload directories (e.g., shell.js); Node.js files containing child_process, exec, or http.createServer patterns in upload paths.
• Logs: Flowise API access logs showing PUT /api/v1/chatflows/ requests modifying chatbotConfig to include application/javascript; POST /api/v1/attachments/ entries with .js filenames and JavaScript MIME types; HTTP server logs showing requests with ?cmd= query parameters.
• Process: Unexpected child processes spawned by the Node.js/Flowise process (e.g., sh, bash, curl, wget, id, whoami); new listening ports opened by the Flowise process (GitHub Advisory).

Upgrade Flowise to version 3.1.0 or later, which fixes this vulnerability by enforcing proper server-side MIME type validation (GitHub Advisory). As interim measures, restrict Chatflow configuration modification permissions to trusted administrators only, and implement server-side file type validation that cannot be bypassed through API-level configuration changes. Audit any .js files that may have been uploaded to the system prior to patching and review Chatflow configurations for unauthorized application/javascript MIME type entries.

The vulnerability was reported by researcher quirmz and published via GitHub's security advisory program on April 15, 2026 (GitHub Advisory). Red Hat tracked the advisory and published their own CVE entry on April 24, 2026 (Red Hat CVE). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.