A high-severity file upload vulnerability in Flowise version 3.0.7 allows authenticated users to achieve Remote Code Execution through the storage of malicious Node.js web shells.

This is an unrestricted file upload vulnerability (CWE-434) residing in the attachment handling logic. Authenticated users can bypass validation mechanisms to store arbitrary files, including Node.js web shells, on the server.

The ability to upload arbitrary files poses a critical risk to system integrity and confidentiality. By storing and subsequently executing malicious scripts, an attacker can gain full control over the application server, leading to unauthorized data access and complete service compromise. The CVSS score of 8.3 reflects the high potential for impact on system integrity and availability.

Immediate Action: Upgrade Flowise to version 3.0.8 or later to resolve the underlying file validation flaw.

Proactive Monitoring: Review application access logs for unusual file upload activity, specifically looking for attempts to upload non-standard file types or requests to suspicious endpoints.

Compensating Controls: Implement strict file upload policies at the Web Application Firewall level to block executable file extensions and ensure that the storage directory for attachments is configured to prevent script execution.

Public Exploit Available: Unknown.

Given the potential for Remote Code Execution and the availability of proof-of-concept information, organizations should prioritize upgrading their Flowise instances to version 3.0.8. If an immediate update is not feasible, restrict access to the file upload functionality to trusted users only and apply rigorous input validation at the network perimeter to mitigate the risk of malicious file injection.