Vulnerability Report

CVE-2026-41269

RCE

Title: MIME Type Bypass for Web Shell Upload

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2026-41269.

CWE Category CWE-434

Published Date Apr 23, 2026

Modified Date Apr 24, 2026

Exploit Status Not Found

Score 7.1 CVSS v3.1

Exploit Probability (EPSS)

0.47%

Vulnerability Summary

CVE-2026-41269: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally allow JavaScript uploads. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). This vulnerability is fixed in 3.1.0.

Impacted Vendors

flowiseai 1

Reference Links

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rh7v-6w34-w2rr

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N