{"id":"EUVD-2026-25286","revision":"23463994b83548b5aeac35ae3d514672","records":[{"revision":"23463994b83548b5aeac35ae3d514672","observedAt":"2026-10-28T05:07:32.823+00:00","statement":{"source":"euvd","id":"EUVD-2026-25286","aliases":["CVE-2026-41269"],"title":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker up…","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally allow JavaScript uploads. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). This vulnerability is fixed in 3.1.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","score":7.1,"severity":null}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rh7v-6w34-w2rr"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25286","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 23, 2026, 7:14:26 PM","dateUpdated":"Apr 24, 2026, 6:20:27 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-25286","identifiers":["EUVD-2026-25286","CVE-2026-41269"]},"retained":false,"historicalAffected":[]}],"coverage":[]}