# CVE-2026-33309: Langflow path traversal and arbitrary file write in v2 API

Source: https://junglewise.ai/threats/cve-2026-33309-langflow-path-traversal-and-arbitrary-file-write-in-v2-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2026-33309 · Severity: critical · CVSS 9.9 · Published 2026-03-19

Langflow, a popular framework for building AI applications, contains a vulnerability that allows logged-in users to write files to any location on the server. By uploading a specially crafted file, an attacker can overwrite critical system files or inject malicious code. This can lead to a complete takeover of the server hosting the Langflow application, potentially exposing sensitive data or disrupting operations.

Technologies: [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-33309 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33309 being exploited in the wild.

**How severe is CVE-2026-33309?** Critical severity, with a CVSS score of 9.9, published 19 March 2026.

**Which products and versions are affected?** langflow (PyPI) ECOSYSTEM:introduced=1.2.0,fixed=1.9.0.

**Is there a fix for CVE-2026-33309?** Yes. langflow (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33309 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33309?** Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langflow (PyPI): upgrade to 1.9.0 or later

  ```sh
  pip install "langflow>=1.9.0"
  ```


## Technical details

A path traversal vulnerability exists in the `POST /api/v2/files/` endpoint of Langflow. The root cause is twofold: the API layer extracts the filename directly from the multipart `Content-Disposition` header without sanitization, and the `LocalStorageService` performs naive path concatenation without verifying that the resulting path remains within the intended directory. An authenticated attacker can use directory traversal sequences (e.g., `../../`) in the filename to write files anywhere on the host filesystem. This can be leveraged for Remote Code Execution by overwriting executable files, Python components, or SSH keys. The issue was addressed in version 1.9.0 by implementing filename sanitization and canonical path containment checks.

## Affected products

- langflow-ai langflow >= 1.2.0, < 1.9.0

## Identifiers

- CVE-2026-33309
- GHSA-g2j9-7rj2-gm6c
- PYSEC-2026-79

## Timeline

- 2026-03-18: disclosed
- 2026-03-19: advisory: GHSA-g2j9-7rj2-gm6c published
- 2026-03-19: patched: Version 1.9.0 released

## References

- [https://api.github.com/users/akshatgit](https://api.github.com/users/akshatgit)
- [https://github.com/akshatgit](https://github.com/akshatgit)
- [https://api.github.com/users/akshatgit/gists%7B/gist_id%7D](https://api.github.com/users/akshatgit/gists%7B/gist_id%7D)
- [https://api.github.com/users/akshatgit/repos](https://api.github.com/users/akshatgit/repos)
- [https://avatars.githubusercontent.com/u/11229971?v=4](https://avatars.githubusercontent.com/u/11229971?v=4)
- [https://api.github.com/users/akshatgit/events%7B/privacy%7D](https://api.github.com/users/akshatgit/events%7B/privacy%7D)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow IP spoofing in MCP configuration installation](https://junglewise.ai/threats/cve-2026-105741-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow path traversal and cross-user disclosure in MCP resources](https://junglewise.ai/threats/cve-2026-105699-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)