CVE-2026-91932: Flowise before 3.1.4 Remote Code Execution via cwd Parameter
Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.4 - Compensating control
Restrict the MCP server configuration so that authenticated attackers cannot control the working directory via the unvalidated cwd parameter (ensure cwd is validated/controlled and not attacker-controlled).
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker must be authenticated and have low-level privileges. Exploitation does not require user interaction, but it does require network access and successful manipulation of MCP server configuration.
Which configurations are exposed?
The issue affects Flowise versions before 3.1.4 where an attacker can control the cwd parameter in MCP server configuration. The provided information does not establish whether this parameter is exposed in a default deployment.
How does the validation bypass work?
An attacker supplies clean filenames in the args array so they pass path validation, while using the unvalidated cwd parameter to control the working directory. This combination can cause malicious code to be executed remotely.
What should be prioritized for remediation?
Upgrade Flowise to version 3.1.4 or later. Until upgrading is possible, restrict low-privileged authenticated users from modifying MCP server configuration, particularly the cwd and args settings.