The vulnerability in FlowiseAI Flowise (CVE-2026-41269) involves unrestricted file upload due to improper validation of MIME types in the Chatflow configuration file upload settings. Prior to version 3.1.0, attackers can modify settings to allow uploads of application/javascript MIME type files, which are normally blocked by the frontend. This allows malicious .js files to be persistently stored on the server, potentially enabling remote code execution via Node.js web shells. The issue is addressed in Flowise version 3.1.0.

Successful exploitation allows attackers with at least low privileges to upload malicious JavaScript files, leading to persistent server-side code execution capabilities. This can result in unauthorized code execution on the server, compromising confidentiality and integrity. The CVSS vector indicates network attack vector, low attack complexity, no user interaction, and partial confidentiality loss with high integrity impact.

Upgrade Flowise to version 3.1.0 or later, where this vulnerability is fixed. Since this is a self-hosted product, administrators must apply the update manually. Patch status is not explicitly stated in vendor advisories but the description confirms the fix in 3.1.0. Until upgraded, restrict access to the file upload functionality to trusted users only.