Flowise
CVE-2026-30821
CRITICAL
GHSA-j8g8-j7fc-43v6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP POST request
-
ExploitBypass MIME type validation with fake Content-Type header
-
ExecutionUpload malicious file to /api/v1/attachments endpoint
-
ImpactExecute arbitrary code via uploaded file
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Flowise versions prior to 3.0.13 with /api/v1/attachments/:chatflowId/:chatId endpoint exposed in WHITELIST_URLS. No authentication required. Attacker must know valid chatflowId and chatId parameters. Target server must have file upload processing enabled. |
| Impact | CVSS 9.8. Flowise instances often have access to LLM API keys and sensitive training data. PoC available. |
| Exploit ScenarioDerived | Attacker uploads web shell through unauthenticated attachment endpoint, executes it to gain server access, steals LLM API keys and prompt data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthenticated attackers to upload and execute malicious files. PoC available.
Earlier versions of this analysis (1)
Arbitrary file upload in Flowise AI workflow builder.
RemediationAI
Update to Flowise 3.0.13. Implement authentication on all API endpoints and file type validation.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-434 unrestricted file upload. The attachments API endpoint lacks authentication and file type validation, enabling upload of web shells or malicious scripts.
Know when Flowise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the /api/v1/attachments/:chatflowId/:chatId endpoint is listed in WHITELIST_URLS, allowing unauthenticated access to the file upload API. While the server validates uploads based on the MIME types defined in chatbotConfig.fullFileUpload.allowedUploadFileTypes, it implicitly trusts the client-provided Content-Type header (file.mimetype) without verifying the file's actual content (magic bytes) or extension (file.originalname). Consequently, an attacker can bypass this restriction by spoofing the Content-Type as a permitted type (e.g., application/pdf) while uploading malicious scripts or arbitrary files. Once uploaded via addArrayFilesToStorage, these files persist in backend storage (S3, GCS, or local disk). This vulnerability serves as a critical entry point that, when chained with other features like static hosting or file retrieval, can lead to Stored XSS, malicious file hosting, or Remote Code Execution (RCE). This issue has been patched in version 3.0.13.
Executive ViewAI
A critical vulnerability in Flowise allows unauthenticated attackers to upload malicious files by bypassing MIME type validation, potentially leading to remote code execution and complete system compromise. This affects any organization using Flowise versions prior to 3.0.13 with file upload capabilities exposed to the internet.
Disable the /api/v1/attachments endpoint entirely until patching is possible; restrict file upload API access through network-level controls (IP whitelisting, VPN requirement); implement Web Application Firewall rules to block requests with suspicious Content-Type mismatches; enforce authentication on all file upload endpoints; disable file execution in upload directories via web server configuration; implement strict file type validation using server-side content analysis (magic bytes) rather than MIME type headers; monitor uploaded files with antivirus/malware detection tools.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Flowise LLM Framework Authentication and Access
View all 5Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flo
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage o
Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Exploit-DB