CVE-2026-41269 - Vulnerability Analysis

Overview

Flowise < 3.1.0 contains an unrestricted file upload vulnerability caused by improper MIME type validation in Chatflow configuration file upload settings, letting attackers upload malicious .js files and persistently store Node.js web shells, exploit requires file upload capability.

Severity & Score

Impact

Attackers can upload malicious files leading to persistent remote code execution on the server.

Mitigation

Update to version 3.1.0 or later.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rh7v-6w34-w2rr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner