by Kastro
Paper/Archive/CVE-2026-91932

CVE-2026-91932

FlowiseAI Flowise — Flowise before 3.1.4 Remote Code Execution via cwd Parameter

EPSS 0.7%public exploitCVSS 9.0
critical.is priorityof 100
48
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 54.4.544 × 2010.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.

Affected

ProductAffectedFixed inSource
Flowise< 3.1.43.1.4CNA
Flowise< 3.1.43.1.4CNA

Scores by source

VulnCheck (CNA)9.0CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
VulnCheck (CNA)8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/FlowiseAI/Flowise/security/advisories/GHSA-x7x8-95gh-42xmwriteupvulncheck.com/advisories/flowise-before-3.1.4-remote-code-execution-via-cwd-parameter