Executive brief
Flowise is an open-source AI workflow and chatbot builder. This vulnerability allows authenticated attackers to bypass file upload restrictions and upload malicious JavaScript files by modifying chatflow configuration settings to include the application/javascript MIME type. Successfully uploaded files can execute arbitrary commands on the server, leading to complete system compromise.
Technical details
The vulnerability is an improper file upload validation flaw (CWE-434) in the createAttachment API endpoint. The Chatflow configuration API (`/api/v1/chatflows/{CHATFLOW_ID}`) fails to validate MIME types server-side, allowing authenticated users to inject application/javascript into the allowedUploadFileTypes list. Although the frontend does not expose JavaScript as an upload option, an attacker with valid credentials can directly modify the chatbotConfig parameter to add this MIME type, then upload .js files to the `/api/v1/attachments/{CHATFLOW_ID}/{CHAT_ID}` endpoint. Once uploaded, the attacker can execute the malicious Node.js script (containing web shells or command execution payloads) if the file is accessed or loaded by the application, resulting in Remote Code Execution. This bypasses a prior patch (GHSA-35g6-rrw3-v6xc / CVE-2025-61687). A fix is available in Flowise version 3.1.0 and later.
Affected products
- FlowiseAI Flowise <=3.0.13
Timeline
- 2026-04-15: disclosed
- 2026-04-16: patched: Version 3.1.0 available