Is CVE-2026-33309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33309 being exploited in the wild.

How severe is CVE-2026-33309?

Critical severity, with a CVSS score of 9.9, published 19 March 2026.

Which products and versions are affected?

langflow (PyPI) ECOSYSTEM:introduced=1.2.0,fixed=1.9.0.

Is there a fix for CVE-2026-33309?

Yes. langflow (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33309 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33309?

Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33309: Langflow path traversal and arbitrary file write in v2 API

CVE-2026-33309 · Severity: critical · CVSS 9.9 · Published 2026-03-19

Langflow, a popular framework for building AI applications, contains a vulnerability that allows logged-in users to write files to any location on the server. By uploading a specially crafted file, an attacker can overwrite critical system files or inject malicious code. This can lead to a complete takeover of the server hosting the Langflow application, potentially exposing sensitive data or disrupting operations.

Technologies: langflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-33309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33309 being exploited in the wild.
How severe is CVE-2026-33309?: Critical severity, with a CVSS score of 9.9, published 19 March 2026.
Which products and versions are affected?: langflow (PyPI) ECOSYSTEM:introduced=1.2.0,fixed=1.9.0.
Is there a fix for CVE-2026-33309?: Yes. langflow (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33309 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33309?: Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

langflow (PyPI): upgrade to 1.9.0 or later
```
pip install "langflow>=1.9.0"
```

Technical details

A path traversal vulnerability exists in the `POST /api/v2/files/` endpoint of Langflow. The root cause is twofold: the API layer extracts the filename directly from the multipart `Content-Disposition` header without sanitization, and the `LocalStorageService` performs naive path concatenation without verifying that the resulting path remains within the intended directory. An authenticated attacker can use directory traversal sequences (e.g., `../../`) in the filename to write files anywhere on the host filesystem. This can be leveraged for Remote Code Execution by overwriting executable files, Python components, or SSH keys. The issue was addressed in version 1.9.0 by implementing filename sanitization and canonical path containment checks.

Affected products

langflow-ai langflow >= 1.2.0, < 1.9.0

Identifiers

CVE-2026-33309
GHSA-g2j9-7rj2-gm6c
PYSEC-2026-79

Timeline

2026-03-18: disclosed
2026-03-19: advisory: GHSA-g2j9-7rj2-gm6c published
2026-03-19: patched: Version 1.9.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.