CVE-2026-91934

Executive Summary

CVE-2026-91934 is a path traversal / arbitrary file write vulnerability (CWE-22) in Flowise, an open-source low-code platform for building LLM applications and orchestration chains. Versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when the node connects to SQLite databases, allowing an authenticated attacker to write arbitrary files on the host. Because unvalidated path handling lets the attacker control where a SQLite database file is written, an attacker can drop a malicious database into sensitive system directories or plant files inside the web root to achieve code execution or persistent stored cross-site scripting (XSS).

The vulnerability carries a CVSS 3.1 base score of 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The impact is severe on both confidentiality and integrity (C:H/I:H), and the attack is network-reachable with low complexity — the only friction is the PR:L (low privileges) requirement, i.e., the attacker must already hold a valid, authenticated account on the Flowise instance. There is no user interaction required (UI:N) and the scope is unchanged (S:U), meaning the vulnerability is contained within the vulnerable component's security authority. No public proof-of-concept, exploit code, or Nuclei template is currently available, and EPSS has not yet scored this CVE.

Technical Analysis

The vulnerability class is CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), applied specifically to an arbitrary file write outcome. The relevant attack surface is the SQL Database Chain node within Flowise, a node type that allows a workflow to connect to an external database and execute SQL as part of a chain. When that node is configured to use SQLite, the database is backed by an on-disk file whose location is supplied as a path. The flaw is that Flowise versions before 3.1.4 do not validate the path supplied for the SQLite database file.

At the code level (as derivable strictly from the NVD description), the mechanism is:

1. Unvalidated path input — the SQLite connection string / database file path accepted by the SQL Database Chain node is not constrained to a safe base directory and is not canonicalized or checked against traversal sequences.
2. Arbitrary write primitive — because SQLite will create or open a database file at the supplied path, an attacker who controls that path can cause the process to create a file at an arbitrary location the Flowise process user can write to. This is the "write arbitrary files" capability described in the advisory.
3. Content is attacker-influenced — SQLite files are attacker-authored content. A malicious SQLite database can be planted in system directories (where it may be consumed by other services or startup logic) or written into the web root so that it becomes directly retrievable, enabling two distinct downstream impacts:
   • Command execution — planting certain files in system/executable directories can lead to code execution depending on how those files are later consumed.
   • Stored XSS — injecting attacker-controlled files into the web root means Flowise (or its reverse proxy) may serve them to other users, and if the injected content is HTML/script-laden, it executes in victims' browsers as stored XSS.

The critical enabler is authentication: exploitation requires a low-privileged authenticated account (PR:L). The advisory does not state that the node itself requires administrative privileges, so any user able to create or edit a chain containing the SQL Database Chain node can potentially reach the vulnerable path. The attack vector is network-based (AV:N) because Flowise is a web application and the malicious configuration is delivered over the network.

What is NOT known / not claimed: No specific API endpoint, JSON parameter name, function name, or class name is given in the NVD description, and none are invented here. No CVE record reference to a fixing commit or version tag is provided beyond the OSV-sourced claim that 3.1.4 fixes the issue. The exact post-write execution path (which system directory or which served file yields code execution vs. stored XSS) is not enumerated in the description and is therefore treated at the vulnerability-class level. No CVSS temporal or environmental scores are available; the environmental score may differ in deployments where the Flowise process runs as a privileged user or where the web root is writable.

Exploitation Scenarios

No public PoC is available for CVE-2026-91934; the attack chain below is inferred from the vulnerability class (CWE-22 path traversal leading to arbitrary file write) and the NVD description. Steps:

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Flowise instance running a version before 3.1.4. Because the vulnerability is authenticated-only, the attacker must first obtain a valid account — through legitimate provisioning, a leaked/default credential, or a separate account-takeover vector. The attacker then fingerprints the version and confirms access to the flow-builder interface where nodes and chains are configured.

2. Triggering the flaw (path traversal / arbitrary write). The attacker creates or edits a chain that includes the SQL Database Chain node configured to use SQLite, and supplies a craftable database file path. Because the path is not validated, the attacker can direct the SQLite database file to any location writable by the Flowise process. The vulnerability class being exploited is improper pathname restriction — the attacker escapes the intended safe directory (e.g., via absolute paths or directory traversal sequences) to reach arbitrary filesystem locations. (No specific parameter name or traversal string is asserted here, as the description does not provide one.)

3. Payload / execution method (class-level). With the arbitrary write primitive, the attacker chooses one of two goals described in the advisory:

   • Code execution path — write a malicious SQLite database (or associated file) into a system directory where the file can influence execution (e.g., a directory whose contents are later consumed by a service or startup mechanism).
   • Stored XSS path — inject files into the web root so they are served to other Flowise users. A crafted HTML/JavaScript file served from the application origin executes in the context of any user who requests it, yielding stored XSS against those users.

4. Post-exploitation impact. Successful exploitation yields high integrity and confidentiality impact: the attacker can overwrite files (integrity), plant persistence artifacts, potentially achieve command execution on the host, and pivot into session/credential theft via stored XSS against privileged users. Depending on the deployment, a web-root write can also enable web shell style persistence or redirection/branding attacks. Because S:U, the impact is bounded to the Flowise host and its users rather than crossing a distinct security authority (e.g., the browser's or the OS's at the scoring level), though real-world code execution can chain further.

Impact Assessment

• Confidentiality (C:H): Stored XSS can exfiltrate session tokens, and injected/served content can expose data to the attacker; file write into directories may also permit reading or leveraging data through subsequent processing.
• Integrity (I:H): Arbitrary file write allows modification/creation of files anywhere the process can write, including web-root content and system directories.
• Availability (A:H): The vector assigns High availability impact per CVSS A:H, consistent with the potential to corrupt or overwrite files and disrupt the running service.
• Attack Vector / Complexity: AV:N (network reachable web application), AC:L (no special conditions described), meaning exploitation is straightforward once authenticated.
• Privileges / Interaction: PR:L (requires a low-privileged authenticated account) and UI:N (no victim interaction needed).
• Scope: S:U — no privilege/channel change at scoring level.

Business impact: Any organization running a self-hosted or cloud-exposed Flowise instance older than 3.1.4 that permits authenticated users (including low-privileged builder accounts) to author chains is in scope. Because the SQL Database Chain node is a built-in capability, exposure can be broad within a Flowise deployment. The worst case is remote code execution on the Flowise server and/or stored XSS against administrative users, both of which commonly lead to full application compromise, data theft, and lateral movement into connected systems. Blast radius includes the Flowise host, its database/secret material, any databases reachable through configured chains, and the browsers of Flowise users (via stored XSS).

Detection Guidance

Detection should focus on (a) Flowise configuration/API activity that supplies unusual SQLite database paths (traversal sequences, absolute paths, web-root paths), (b) creation of unexpected SQLite or web-servable files, and (c) Flowise process writes outside intended data directories. Rules below are behavioral/path-based because the description provides no specific parameter names.

Sigma Rule

title: Flowise SQL Database Chain SQLite Arbitrary File Write (CVE-2026-91934)
id: 8f3a2c14-9193-4c7e-b1a2-flowise91934
status: experimental
description: Detects suspicious SQLite database file paths submitted to Flowise SQL Database Chain node, indicating path traversal / arbitrary file write attempts (CWE-22).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91934
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: flowise
detection:
  selection_webroot:
    http.url|contains:
      - '/api/v1/node'
      - '/api/v1/chatflows'
    http.body|contains:
      - 'sqlite'
  selection_traversal:
    http.body|contains:
      - '../'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '/var/www'
      - '/etc/'
      - '/usr/'
      - 'C:\\'
      - '/tmp/'
  condition: selection_webroot and selection_traversal
falsepositives:
  - Legitimate administrators intentionally pointing SQLite to custom directories in development environments
level: high
tags:
  - attack.t1505
  - attack.t1190
  - cve.2026.91934

YARA Rule

rule CVE_2026_91934_Flowise_Arbitrary_Write_Indicators
{
    meta:
        description = "Detects indicators of Flowise SQL Database Chain SQLite path traversal / arbitrary file write (CVE-2026-91934)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91934"
        date = "2026-01-01"
        severity = "high"

    strings:
        $sqlite   = "sqlite" ascii nocase
        $node_sql = "SQL Database Chain" ascii nocase
        $trav1    = "../" ascii
        $trav2    = "..\\" ascii
        $webroot1 = "/var/www" ascii
        $webroot2 = "wwwroot" ascii nocase
        $etc1     = "/etc/" ascii
        $tmp1     = "/tmp/" ascii
        $fnode    = "SQLDatabaseChain" ascii nocase

    condition:
        (uint32(0) == 0x53514C69) or  // "SQLi" - SQLite file magic "SQLite format 3\0"
        (
            filesize < 20MB and
            ( $fnode or $node_sql ) and
            $sqlite and
            any of ($trav*) and
            any of ($webroot*, $etc1, $tmp1)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91934 Flowise SQL Database Chain SQLite Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/"; http.request_body; content:"sqlite"; nocase; http.request_body; pcre:"/(\.\.\/|%2e%2e%2f|%2e%2e\/|\/var\/www|\/etc\/|\/usr\/|wwwroot)/i"; reference:cve,CVE-2026-91934; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91934; classtype:attempted-admin; sid:202691934; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [ any where process.name == "node" and process.args : "*flowise*" ]
  [ file where event.action in ("creation", "modification") and
      file.path : ("/var/www/*", "/usr/*", "/etc/*", "C:\\*") and
      (file.extension in ("sqlite","sqlite3","db") or file.name : "*.html" or file.name : "*.js") ]

Splunk SPL Query

index=flowise OR index=web
  (uri="/api/v1/*")
  (body="*sqlite*" OR body="*SQLITE*")
  (body="*../*" OR body="*%2e%2e*" OR body="*/var/www*" OR body="*/etc/*" OR body="*wwwroot*")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(src_ip) as src_ips by user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="flowise,web,cve-2026-91934,">
  <rule id="202691934" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.url">/api/v1/</field>
    <regex field="http.body">(?i)(sqlite).*(\.\./|%2e%2e|/var/www|/etc/|wwwroot)</regex>
    <description>CVE-2026-91934: Flowise SQL Database Chain SQLite path traversal / arbitrary file write attempt</description>
    <mitre>
      <id>T1505</id>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_91934,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) claims that version 3.1.4 fixes CVE-2026-91934. This is not independently confirmed; the CVE record lists no vendor-fix reference, no affected-version array, and no workaround. Treat the 3.1.4 fix as provisional and verify against the official Flowise repository/advisory before relying on it.

1. Immediate mitigations (until patch is verified):

   • Restrict access to the Flowise instance at the network layer (VPN, IP allowlist, authenticated reverse proxy) so only trusted operators can reach the flow-builder UI — this directly addresses the PR:L authentication requirement and reduces the exposed attack surface.
   • Audit existing chains for any SQL Database Chain node configured with SQLite and inspect the configured database file paths for traversal sequences or absolute paths pointing outside intended directories.
   • Harden file system permissions: run the Flowise process as a low-privilege, dedicated service account with write access restricted to a single, dedicated data directory. Ensure the web root and system directories (/etc, /usr, web-serving paths, wwwroot, etc.) are not writable by the Flowise process user. This removes the arbitrary-write primitive's usefulness even if the path is not validated.
   • Remove or disable the SQL Database Chain node / SQLite connectivity if it is not required in production, or restrict who can author such nodes.
   • Monitor for unexpected SQLite/database/HTML/JS files appearing in web-root and system directories (see Detection Guidance).

2. Patch / upgrade steps:

   • Upgrade Flowise to 3.1.4 or later (per the OSV claim). Because the patch claim is a single source, confirm the fix by reviewing the Flowise changelog/release notes and testing in a staging environment before production rollout.
   • After upgrade, re-validate that the SQL Database Chain node properly constrains SQLite database paths and that no legacy traversal-configured nodes remain in saved chains.
   • Re-scan the filesystem for unauthorized SQLite files or web-servable injected content authored before remediation, and remove anything suspicious.

3. Long-term hardening:

   • Enforce path canonicalization and directory containment checks on all user-supplied file paths (allowlist a base directory; reject traversal sequences and absolute paths outside it) — the control missing in affected versions.
   • Apply least privilege to the Flowise runtime: no write access to web root or system directories; containerize the service with a read-only root filesystem and explicit writable volumes.
   • Enforce strong authentication and RBAC and monitor for account abuse, given exploitation requires an authenticated low-privileged account.
   • Add file-integrity monitoring (FIM) on web-root and system directories with alerting on new/modified .sqlite, .db, .html, .js files.
   • Deploy the detection rules above and ship Flowise application/web logs to the SIEM for correlation.

References

• NVD — CVE-2026-91934: https://nvd.nist.gov/vuln/detail/CVE-2026-91934
• OSV — advisory record citing the 3.1.4 fix (single-source, unconfirmed patch claim): https://osv.dev/vulnerability/CVE-2026-91934
• Flowise (project) — official repository and release notes for version 3.1.4: https://github.com/FlowiseAI/Flowise
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK — T1505 Server Software Component / T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1505/

Threat actor / exploit-in-the-wild status: No public PoC, exploit code, or Nuclei template is available as of this report, there is no CISA KEV listing, and no known threat actor campaign has been associated with CVE-2026-91934. EPSS has not yet been scored by FIRST.org. The absence of public exploitation to date should not reduce urgency, given the High CVSS base score and the authenticated-only but low-complexity attack path.