What is CVE-2026-91932?

CVE-2026-91932 is a high-severity vulnerability in Flowiseai Flowise, classified under Improper Input Validation. CVSS score: 8.5/10. Published 2026-09-15.

How severe is CVE-2026-91932?

High severity. CVSS v3 base score is 8.5 out of 10.

Improper input validation in Flowiseai Flowise

CVE-2026-91932

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

CVSS v3 metric

CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Flowiseai Flowise

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-91932?: CVE-2026-91932 is a high-severity vulnerability in Flowiseai Flowise, classified under Improper Input Validation. CVSS score: 8.5/10. Published 2026-09-15.
How severe is CVE-2026-91932?: High severity. CVSS v3 base score is 8.5 out of 10.