CVE-2026-33309: langflow-ai langflow Path Traversal
Vulnerability summary
CVE-2026-33309 is a critical (CVSS 10.0) Path Traversal vulnerability in langflow-ai langflow. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 65% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 24-03-2026PublishedVulnerability first disclosed.
- 25-03-2026Last modifiedVulnerability information updated.
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName` dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · PypiEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HDiffers
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
-9.98 pp
From 11.06% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLangflow
Maturity: poc
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Langflow1 product
- langflow≥ 1.2.0, < 1.9.0
Langflow-ai1 product
- langflow≥ 1.2.0, < 1.9.0
PyPI1 product
- langflow≥ 1.2.0, < 1.9.0
3 vendors · 3 products
References
4 links- github.com/langflow-ai/langflow/security/advisories/GHSA-g2j9-7rj2-gm6cX Refsource CONFIRMWEBEVIDENCEExploitMitigationVendor Advisory
