Flowise is a drag‑and‑drop interface for building language‑model flows. In versions prior to 3.0.13 the file‑upload endpoint /api/v1/attachments/:chatflowId/:chatId is listed in a whitelist and thus permits unauthenticated uploads. The server validates file type only against a list of allowed MIME types supplied by the client and does not inspect the file’s magic bytes nor its actual extension. By spoofing a permitted MIME type such as application/pdf an attacker can upload arbitrary or malicious scripts; the files are then stored in backend storage (S3, GCS, or local disk) and may be later retrieved or served, providing an entry point for stored XSS, malicious file hosting, or Remote Code Execution.

The vulnerability affects FlowiseAI’s Flowise product, specifically all instances running a version older than 3.0.13. The attack surface is the upload endpoint exposed for building chat‑flow attachments; no other vendors or product variants are implicated by the available data.

The CVSS score of 8.2 underscores a high severity impact. A current EPSS score of less than 1% indicates that active exploitation is unlikely at present, though the vulnerability remains present. The flaw is not listed in the CISA KEV catalog, meaning no publicly known exploited instances have been reported. Attackers can reach the endpoint from any remote location that can communicate with the Flowise server, and because the validation relies on the client‑supplied Content‑Type header, it is straightforward to bypass unless mitigated.