CVE-2026-43995 | FlowiseAI Flowise up to 3.0.12 API Document Loader APILoader.ts axios.get pageContent server-side request forgery

A vulnerability was found in FlowiseAI Flowise up to 3.0.12. It has been declared as critical. This vulnerability affects the function axios.get of the file packages/components/nodes/documentloaders/API/APILoader.ts of the component API Document Loader Component. Executing a manipulation of the argument pageContent can lead to server-side request forgery.

This vulnerability is handled as CVE-2026-43995. The attack can be executed remotely. Additionally, an exploit exists.

It is recommended to upgrade the affected component.