Flowise EUVD-2026-25286

Exploitation requires an authenticated Flowise account with permission to modify a Chatflow's file-upload configuration (PR:L in the CVSS vector) - it is not anonymous. The concrete precondition is the ability to edit the Chatflow upload settings to add the application/javascript MIME type, which then allows .js files to be uploaded through the createAttachment path even though the frontend never offers JavaScript as an option. What limits exploitation: the attacker must already have valid credentials/session (the PoC uses a JWT token cookie for an 'admin' user) and Chatflow-edit rights; achieving actual code execution further depends on the uploaded .js file being executed by the Node.js runtime rather than merely stored. No specific user interaction from a victim and no non-default OS platform is required - only versions before 3.1.0.

The signals are mixed and point to a real-but-not-mass-exploitation issue. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N): network reachable, low complexity, but crucially requiring PR:L - the attacker must already be authenticated with rights to modify a Chatflow configuration, which materially constrains the population of real attackers. SSVC frames it as Exploitation: poc, Automatable: no, Technical Impact: partial, consistent with a targeted rather than wormable threat. EPSS is only 0.06% (19th percentile), and there is no CISA KEV listing, so there is no evidence of active exploitation despite public PoC code. The most important caveat: the base CVSS rates only C:L/I:H/A:N, but a successful Node.js web shell yields OS command execution, which in practice implies high confidentiality and availability impact too - the scored vector appears to understate true impact if the upload reliably reaches an executable path. Priority should be driven by whether the Flowise instance is internet-exposed and how loosely Chatflow-edit privileges are granted.

An attacker with a low-privileged Flowise account that can edit a Chatflow modifies the upload configuration to permit the application/javascript MIME type, then uploads shell.js - a Node.js web shell that exposes a ?cmd= HTTP interface. A working PoC (both the web shell and a Python upload script using a valid JWT cookie) is published in the GHSA advisory, and given AV:N/AC:L the upload step is straightforward once authenticated. If the stored file is reachable/executed by the server runtime, the attacker gains arbitrary command execution in the Flowise process context.