What is the CVSS score of CVE-2026-30821?

CVE-2026-30821 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of AI / ML are affected by CVE-2026-30821?

A critical vulnerability in Flowise allows unauthenticated attackers to upload malicious files by bypassing MIME type validation, potentially leading to remote code execution and complete system…. A patch is available.

Is there a public PoC exploit available for CVE-2026-30821?

Yes, a public proof-of-concept exploit is available for CVE-2026-30821. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-30821?

Within 24 hours: Immediately disable the /api/v1/attachments endpoint or restrict it to authenticated users only; review access logs for suspicious file uploads. Within 7 days: Implement WAF rules to block requests to vulnerable endpoints or require authentication; conduct forensic analysis of uploaded files for malicious content. Within 30 days: Upgrade to Flowise 3.0.13 or later once available; implement file type validation on the server side with magic number verification rather than relying on Content-Type headers; deploy runtime application self-protection (RASP) to detect file execution attempts.

AI / ML CVE-2026-30821

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-07 security-advisories@github.com

GHSA-j8g8-j7fc-43v6

RCE AI / ML Flowise

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 11, 2026 - 13:45 vuln.today

Public exploit code

CVE Published

Mar 07, 2026 - 05:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the /api/v1/attachments/:chatflowId/:chatId endpoint is listed in WHITELIST_URLS, allowing unauthenticated access to the file upload API. While the server validates uploads based on the MIME types defined in chatbotConfig.fullFileUpload.allowedUploadFileTypes, it implicitly trusts the client-provided Content-Type header (file.mimetype) without verifying the file's actual content (magic bytes) or extension (file.originalname). Consequently, an attacker can bypass this restriction by spoofing the Content-Type as a permitted type (e.g., application/pdf) while uploading malicious scripts or arbitrary files. Once uploaded via addArrayFilesToStorage, these files persist in backend storage (S3, GCS, or local disk). This vulnerability serves as a critical entry point that, when chained with other features like static hosting or file retrieval, can lead to Stored XSS, malicious file hosting, or Remote Code Execution (RCE). This issue has been patched in version 3.0.13.

AnalysisAI

Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthenticated attackers to upload and execute malicious files. PoC available.

Technical ContextAI

CWE-434 unrestricted file upload. The attachments API endpoint lacks authentication and file type validation, enabling upload of web shells or malicious scripts.