Executive brief
Langflow, a tool for building AI-powered workflows, is vulnerable to a security flaw that allows attackers to read sensitive files from the server. By uploading a specially crafted archive file (such as a .tar file) containing symbolic links, an attacker can trick the system into accessing internal configuration files, including secret keys. This can lead to full administrative takeover of the platform and the ability to execute unauthorized code on the underlying server.
Technical details
A vulnerability exists in the `BaseFileComponent._unpack_bundle` method of Langflow where TAR archive extraction does not properly validate or reject symbolic links. An attacker can upload a TAR file containing a symlink pointing to sensitive local files (e.g., JWT secret keys). When the component processes the extracted files, it follows the symlink and ingests the target file's content into the RAG (Retrieval-Augmented Generation) system, making it accessible to the attacker. This exposure of the JWT secret key allows for the forgery of administrative tokens, which can then be used to achieve Remote Code Execution (RCE) via the 'Python Interpreter' node. The issue affects all components inheriting from `BaseFileComponent`, including Docling, FileComponent, and NvidiaIngestComponent. The fix in version 1.9.2 implements stricter validation to reject symlinks, hardlinks, and non-regular files during extraction.
Affected products
- langflow-ai Langflow < 1.9.2
Timeline
- 2026-04-30: patched: Fix merged in pull request 12945
- 2026-06-19: advisory: GitHub Security Advisory GHSA-ccv6-r384-xp75 published
- 2026-06-23: disclosed: CVE-2026-55447 published to NVD