CVE-2026-91934 is a path traversal vulnerability affecting Flowise versions prior to 3.1.4. The vulnerability exists because the SQL Database Chain node does not properly validate file paths when connecting to SQLite databases. Authenticated attackers can exploit this to write arbitrary files to restricted directories, including system directories or the web root. This can facilitate execution of arbitrary commands or stored XSS attacks by injecting malicious files. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated attacker to write arbitrary files on the system, potentially leading to remote code execution or stored XSS attacks. This compromises confidentiality, integrity, and availability of the affected system.

Upgrade Flowise to version 3.1.4 or later, where this vulnerability is fixed. Since the affected versions are explicitly prior to 3.1.4, applying the official update eliminates the risk. No other mitigation is specified.