CVE-2026-33309: Langflow path traversal and arbitrary file write in v2 API

Executive brief

Langflow, a popular framework for building AI applications, contains a vulnerability that allows logged-in users to write files to any location on the server. By uploading a specially crafted file, an attacker can overwrite critical system files or inject malicious code. This can lead to a complete takeover of the server hosting the Langflow application, potentially exposing sensitive data or disrupting operations.

Technical details

A path traversal vulnerability exists in the `POST /api/v2/files/` endpoint of Langflow. The root cause is twofold: the API layer extracts the filename directly from the multipart `Content-Disposition` header without sanitization, and the `LocalStorageService` performs naive path concatenation without verifying that the resulting path remains within the intended directory. An authenticated attacker can use directory traversal sequences (e.g., `../../`) in the filename to write files anywhere on the host filesystem. This can be leveraged for Remote Code Execution by overwriting executable files, Python components, or SSH keys. The issue was addressed in version 1.9.0 by implementing filename sanitization and canonical path containment checks.

Affected products

• langflow-ai langflow >= 1.2.0, < 1.9.0

Timeline

• 2026-03-18: disclosed
• 2026-03-19: advisory: GHSA-g2j9-7rj2-gm6c published
• 2026-03-19: patched: Version 1.9.0 released

References

• https://api.github.com/users/akshatgit
• https://github.com/akshatgit
• https://api.github.com/users/akshatgit/gists%7B/gist_id%7D
• https://api.github.com/users/akshatgit/repos
• https://avatars.githubusercontent.com/u/11229971?v=4
• https://api.github.com/users/akshatgit/events%7B/privacy%7D