Executive brief
Langflow is a platform used to build and deploy AI-powered workflows and agents. A security flaw in its "Shareable Playground" feature allows unauthorized users to potentially read sensitive files from the server or connected cloud storage (S3). If a workflow is made public, an attacker could manipulate the execution request to access internal configuration files or private data, which are then processed by the AI model.
Technical details
An arbitrary file-read vulnerability exists in Langflow's "Shareable Playground" (Public Flows) feature due to improper validation of user-supplied file paths. The vulnerability is rooted in the `/api/v1/build_public_tmp` endpoint, where the `files` field in the execution request is processed by `LCModelComponent._get_chat_result` and `to_lc_message`. An unauthenticated attacker can provide arbitrary local filesystem paths or S3 URIs, which the application then reads and feeds into the Large Language Model (LLM) as input. Depending on the LLM's configuration and the flow's design, the contents of these files can be exfiltrated. This issue is classified as CWE-73 (External Control of File Name or Path) and is resolved in version 1.10.0.
Affected products
- langflow-ai Langflow < 1.10.0
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD