PT-2026-34734 · Flowise · Flowise

Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41269

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description The Chatflow configuration file upload settings can be modified to allow the 'application/javascript' MIME type. This allows the upload of .js files, bypassing frontend restrictions. An attacker can use this to persistently store malicious Node.js web shells on the server, which may lead to Remote Code Execution (RCE), a process where an attacker can execute arbitrary commands on the target machine.

Recommendations Update to version 3.1.0.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-41269

GHSA-RH7V-6W34-W2RR

Affected Products

Flowise

References · 5

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rh7v-6w34-w2rr · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41269 · Security Note
• https://osv.dev/vulnerability/GHSA-rh7v-6w34-w2rr · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/CVEnew/status/2047428077404520800 · Twitter Post