CVE-2026-30821

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the /api/v1/attachments/:chatflowId/:chatId endpoint is listed in WHITELIST_URLS, allowing unauthenticated access to the file upload API. While the server validates uploads based on the MIME types defined in chatbotConfig.fullFileUpload.allowedUploadFileTypes, it implicitly trusts the client-provided Content-Type header (file.mimetype) without verifying the file's actual content (magic bytes) or extension (file.originalname). Consequently, an attacker can bypass this restriction by spoofing the Content-Type as a permitted type (e.g., application/pdf) while uploading malicious scripts or arbitrary files. Once uploaded via addArrayFilesToStorage, these files persist in backend storage (S3, GCS, or local disk). This vulnerability serves as a critical entry point that, when chained with other features like static hosting or file retrieval, can lead to Stored XSS, malicious file hosting, or Remote Code Execution (RCE). This issue has been patched in version 3.0.13.

An adversary scans for publicly accessible Flowise instances (trivially found via Shodan/Censys querying for Flowise's default port and UI fingerprint). They POST to /api/v1/attachments/{chatflowId}/{chatId} with a request body containing a PHP webshell payload (<?php system($_GET['cmd']); ?>), but set the Content-Type header to application/pdf. Flowise's validation sees application/pdf (an allowed type), stores the file as chatflowId_chatId_webshell.php in the configured backend. If storage is local disk with a web-accessible path, the attacker directly requests the file to trigger RCE. If using S3/GCS with public or semi-public bucket policies, the file is accessible externally and can be delivered as a malicious payload to downstream users. The attacker then achieves full host access, exfiltrating all LLM API keys, database credentials, and configured flow secrets — turning the Flowise node into a persistent foothold within the organization's AI infrastructure.