Description

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-15T16:17:44.030Z",
  "pubdate": "2026-09-15T16:17:44.030Z",
  "executiveSummary": "Flowise versions prior to 3.1.4 are susceptible to a critical remote code execution (RCE) vulnerability stemming from improper input validation within the Model Context Protocol (MCP) server configuration component.\nThe vulnerability allows an authenticated attacker to bypass path validation mechanisms by manipulating the 'cwd' (current working directory) parameter.\nBy controlling the working directory context, an attacker can influence the execution environment of provided arguments, leading to arbitrary code execution on the host system.\nThis flaw poses a severe risk to the confidentiality, integrity, and availability of the underlying server infrastructure.\nSuccessful exploitation requires the attacker to have authenticated access to the application, after which they can achieve command execution outside of intended operational boundaries.\nOrganizations deploying Flowise must treat this as a high-priority security concern due to the direct impact on host system security and the potential for full system compromise.",
  "technicalDetails": "The vulnerability exists within the MCP server configuration module of Flowise, specifically concerning the handling of the 'cwd' parameter when defining server startup parameters.\nThe root cause of the flaw is an insufficient validation logic that fails to adequately sanitize or restrict the 'cwd' parameter, which dictates the directory from which the MCP server processes are spawned.\nAlthough the application attempts to enforce path validation for the 'args' array, the implementation allows for a bypass by utilizing clean filenames that are technically valid within the execution flow, but contextually dangerous when paired with a malicious 'cwd'.\nAn authenticated attacker can exploit this by crafting a configuration request that specifies an arbitrary directory via the 'cwd' parameter. By setting this to a location containing attacker-controlled scripts or binaries, or by manipulating relative paths, the attacker forces the system to interpret subsequent command arguments within an unintended and potentially dangerous environment.\nThe attack flow follows a structured exploitation path: First, the attacker authenticates to the Flowise instance. Second, the attacker interacts with the MCP server configuration interface to define a new server entry. Third, the attacker injects a malicious payload into the 'cwd' parameter while providing carefully selected filenames within the 'args' array that bypass secondary path checks.\nUpon saving or initializing the configuration, the server process spawns with the attacker-specified working directory. This mismatch between the intended execution context and the manipulated directory allows the attacker to execute arbitrary commands or leverage existing files on the filesystem to trigger malicious payloads.\nBecause the 'cwd' parameter directly influences the environment in which commands are executed, the process effectively executes under the privileges of the Flowise server process itself. Consequently, the post-exploitation impact includes full command execution, unauthorized access to sensitive application data, potential lateral movement within the network, and the capability to establish persistence on the host infrastructure.\nThe lack of strict canonicalization and path restriction for the 'cwd' input remains the primary technical failure, as the system trusts user-provided directory paths without verifying if the path is permitted or safe for process execution."
}