Executive brief
Langflow is an open-source framework for building AI applications with visual workflows. The file upload endpoint fails to validate user input, allowing authenticated attackers to write files to arbitrary locations on the server using path traversal sequences. This could lead to remote code execution, data corruption, or complete system compromise.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in the POST /api/v2/files endpoint. The 'filename' parameter from multipart form data is not sanitized, allowing attackers to inject sequences like '../' to write files outside the intended directory. The vulnerability requires authentication (PR:L in CVSS), but no user interaction is needed. A successful exploit enables arbitrary file write operations, potentially allowing remote code execution depending on the application's file permissions and subsequent execution paths. The fix is available in Langflow version 1.9.0 and later.
Affected products
- Langflow Langflow before 1.9.0
Timeline
- 2026-03-27: disclosed: Tenable Research Advisory TRA-2026-26 published
- 2026-06-11: patched: Vendor confirmed fix in version 1.9.0