TI-2026-25720 Aliases CVE-2026-33309 GHSA-g2j9-7rj2-gm6c

Langflow has an Arbitrary File Write (RCE) via v2 API

HIGH 76CWE-22Published 2026-03-24 · Updated 2026-03-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass, Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284 and CWE-94.

Summary

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName` dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.13467 96th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed langflow (langflow-ai): 1.9.0langflow (PyPI): 1.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Langflow	langflow	1.2.0 to before 1.9.0	1.9.0	Patch available	CNA
—	langflow (PyPI)	1.2.0 to before 1.9.0	1.9.0	Patch available	GHSA-g2j9-7rj2-gm6c

langflow VendorLangflow Affected 1.2.0 to before 1.9.0 Fixed in 1.9.0 Patch available CNA
langflow (PyPI) Vendor— Affected 1.2.0 to before 1.9.0 Fixed in 1.9.0 Patch available GHSA-g2j9-7rj2-gm6c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:langflow:langflow::::::::	1.2.0 to before 1.9.0	Vulnerable	Langflow

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* Versions 1.2.0 to before 1.9.0 Vulnerable ·Langflow

Remediation

Fix · CNA langflow (langflow-ai) Fixed in 1.9.0
Fix · GHSA-g2j9-7rj2-gm6c langflow (PyPI) Fixed in 1.9.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-33309
2026-10-03 Alias added: GHSA-g2j9-7rj2-gm6c
2026-10-25 EPSS moved to the 95th–99th percentile

References

Exploit 1

https://github.com/langflow-ai/langflow/security/advisories/GHSA-g2j9-7rj2-gm6c

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-33309

Other 2

TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
TI-2026-00553 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote… KEVCVSS 3.0CRITICAL 9.8
TI-2025-24427 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE KEVCVSS 4.0CRITICAL 9.4
TI-2025-02845 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code KEVCVSS 3.1CRITICAL 9.8
TI-2026-25463 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint KEVCVSS 4.0CRITICAL 9.3
TI-2026-39928 Authorization bypass in langflow KEVCVSS 3.1HIGH 8.4

See all 216 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences