CVE-2026-91934: Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated Flowise account with access to configure or use the SQL Database Chain node and connect it to a SQLite database. No user interaction is required after the attacker has that access.
Which deployments are affected?
Flowise versions before 3.1.4 are affected when the SQL Database Chain node is used with SQLite. The provided information does not establish whether SQLite use or access to this node is enabled by default.
What can an attacker do with successful exploitation?
The attacker can write arbitrary files by supplying unvalidated file paths for SQLite databases. This may allow malicious database files to be placed in system directories, files to be injected into a web root for command execution, or stored XSS payloads to be introduced.
What should be done if upgrading is not immediately possible?
Restrict access to Flowise accounts and to the SQL Database Chain node, particularly for users who do not need SQLite connections. Limit the Flowise process's filesystem permissions so it cannot write to system directories or web-accessible locations.