CVE-2026-33309 PUBLISHED

Langflow has an Arbitrary File Write (RCE) via v2 API

Assigner: GitHub_M
Reserved: 18.03.2026 Published: 24.03.2026 Updated: 24.03.2026

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within LocalStorageService remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer ValidatedFileName dependency. This defense-in-depth failure leaves the POST /api/v2/files/ endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Product Status

Vendor langflow-ai
Product langflow
Versions
  • Version >= 1.2.0, < 1.9.0 is affected

References

Problem Types

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
  • CWE-73: External Control of File Name or Path CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE
  • CWE-284: Improper Access Control CWE