GitHub Security Advisory: GHSA-j8g8-j7fc-43v6
Package: flowise (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 3.0.12
Patched in: 3.0.13

Summary: Flowise has Arbitrary File Upload via MIME Spoofing

Details:
### Vulnerability **Description**

---

**Vulnerability Overview**
 
- The `/api/v1/attachments/:chatflowId/:chatId` endpoint is listed in `WHITELIST_URLS`, allowing unauthenticated access to the file upload API.
- While the server validates uploads based on the MIME types defined in `chatbotConfig.fullFileUpload.allowedUploadFileTypes`, it implicitly trusts the client-provided `Content-Type` header (`file.mimetype`) without verifying the file's actual content (magic bytes) or extension (`file.originalname`).
- Consequently, an attacker can bypass this restriction by spoofing the `Content-Type` as a permitted type (e.g., `application/pdf`) while uploading malicious scripts or arbitrary files. Once uploaded via `addArrayFilesToStorage`, these files persist in backend storage (S3, GCS, or local disk). This vulnerability serves as a critical entry point that, when chained with other features like static hosting or file retrieval, can lead to Stored XSS, malicious file hosting, or Remote Code Execution (RCE).

**Vulnerable Code**

- Upload Route Definition
    
    https://github.com/FlowiseAI/Flowise/blob/d17c4394a238b49327b493c89feee45f3a20bb91/packages/server/src/routes/attachments/index.ts#L7-L10
    
    ```tsx
    // CREATE
    router.post('/:chatflowId/:chatId', getMulterStorage().array('files'), attachmentsController.createAttachment)
    export default router
    ```
    
- Mount /api/v1/attachments to the global router
    
    https://github.com/FlowiseAI/Flowise/blob/d17c4394a238b49327b493c89feee45f3a20bb91/packages/server/src/routes/index.ts#L72-L77
    
    ```tsx
    const router = express.Router()
    router.use('/ping', pingRouter)
    router.use('/apikey', apikeyRouter)
    router.use('/assistants', assistantsRouter)
    router.use('/attachments', attachmentsRouter)
    ```
    
- Include /api/v1/attachments in the WHITELIST_URLS list
    
    https://github.com/FlowiseAI/Flowise/blob/d17c4394a238b49327b493c89feee45f3a20bb91/packages/server/src/utils/constants.ts#L6-L26
    
    ```tsx
    export const WHITELIST_URLS = [
        '/api/v1/verify/apikey/',
        '/api/v1/chatflows/apikey/',
        '/api/v1/public-chatflows',
        '/api/v1/public-chatbotConfig',
        '/api/v1/public-executions',
        '/api/v1/prediction/',
        '/api/v1/vector/upsert/',
        '/api/v1/node-icon/',
        '/api/v1/components-credentials-icon/',
        '/api/v1/chatflows-streaming',
        '/api/v1/chatflows-uploads',
        '/api/v1/openai-assistants-file/download',
        '/api/v1/feedback',
        '/api/v1/leads',
        '/api/v1/get-upload-file',
        '/api/v1/ip',
        '/api/v1/ping',
        '/api/v1/version',
        '/api/v1/attachments',
        '/api/v1/metrics',
    ```
    
- Bypass JWT validation if the URL is whitelisted
    
    https://github.com/FlowiseAI/Flowise/blob/d17c4394a238b49327b493c89feee45f3a20bb91/packages/server/src/index.ts#L213-L228
    
    ```tsx
            const denylistURLs = process.env.D