# CVE-2026-55447: Langflow arbitrary file read and RCE via symlink following in BaseFileComponent

Source: https://junglewise.ai/threats/cve-2026-55447-langflow-arbitrary-file-read-and-rce-via-symlink-following-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-55447 · Severity: critical · CVSS 9.6 · Published 2026-06-23

Langflow, a tool for building AI-powered workflows, is vulnerable to a security flaw that allows attackers to read sensitive files from the server. By uploading a specially crafted archive file (such as a .tar file) containing symbolic links, an attacker can trick the system into accessing internal configuration files, including secret keys. This can lead to full administrative takeover of the platform and the ability to execute unauthorized code on the underlying server.

Technologies: [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-55447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55447 being exploited in the wild.

**How severe is CVE-2026-55447?** Critical severity, with a CVSS score of 9.6, published 23 June 2026.

**Which products and versions are affected?** langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.9.2.

**Is there a fix for CVE-2026-55447?** Yes. langflow (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55447 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55447?** Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langflow (PyPI): upgrade to 1.9.2 or later

  ```sh
  pip install "langflow>=1.9.2"
  ```


## Technical details

A vulnerability exists in the `BaseFileComponent._unpack_bundle` method of Langflow where TAR archive extraction does not properly validate or reject symbolic links. An attacker can upload a TAR file containing a symlink pointing to sensitive local files (e.g., JWT secret keys). When the component processes the extracted files, it follows the symlink and ingests the target file's content into the RAG (Retrieval-Augmented Generation) system, making it accessible to the attacker. This exposure of the JWT secret key allows for the forgery of administrative tokens, which can then be used to achieve Remote Code Execution (RCE) via the 'Python Interpreter' node. The issue affects all components inheriting from `BaseFileComponent`, including Docling, FileComponent, and NvidiaIngestComponent. The fix in version 1.9.2 implements stricter validation to reject symlinks, hardlinks, and non-regular files during extraction.

## Affected products

- langflow-ai Langflow < 1.9.2

## Identifiers

- CVE-2026-55447
- GHSA-ccv6-r384-xp75
- PYSEC-2026-378

## Timeline

- 2026-04-30: patched: Fix merged in pull request 12945
- 2026-06-19: advisory: GitHub Security Advisory GHSA-ccv6-r384-xp75 published
- 2026-06-23: disclosed: CVE-2026-55447 published to NVD

## References

- [https://github.com/langflow-ai/langflow/pull/12945](https://github.com/langflow-ai/langflow/pull/12945)
- [https://github.com/langflow-ai/langflow/security/advisories/GHSA-ccv6-r384-xp75](https://github.com/langflow-ai/langflow/security/advisories/GHSA-ccv6-r384-xp75)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow IP spoofing in MCP configuration installation](https://junglewise.ai/threats/cve-2026-105741-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow path traversal and cross-user disclosure in MCP resources](https://junglewise.ai/threats/cve-2026-105699-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)