CVE-2026-91934
Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 15, 2026
- Updated
- Sep 15, 2026
- Reserved
- Sep 15, 2026
Description
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
FlowiseFlowiseAI |
|
FlowiseFlowiseAI |
|
References
- GitHub Security Advisory (GHSA-pwfj-wh95-7mwp)vendor-advisory
- VulnCheck Advisory: Flowise before 3.1.4 Remote Code Execution via SQL Database Chainthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.