Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Flowise before 3.1.4 lets logged‑in users add files

CVE-2026-91934 · published 24 days ago
Summary

Versions of Flowise earlier than 3.1.4 do not check file locations when using the SQLite database feature. A user who has a valid account can place arbitrary files on the server, including harmful databases or scripts that could be run later. Update Flowise to version 3.1.4 or newer, or limit user access to trusted accounts until the upgrade is applied.

What to do
  • Update flowiseai flowise to version 3.1.4 or later.
Affected software
VendorProductAffected versions
flowiseai flowise < 3.1.4
Original advisory text
Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published15 Sep 2026
Updated7 Oct 2026
First seen15 Sep 2026
Sources
CVE-2026-91934 · NVD
CVE-2026-91934 · MITRE
CVE-2026-91934 · OSV
GHSA-pwfj-wh95-7mwp · GHSA
Track software like this
Free during beta