LangflowPublished 27 Mar 2026NVD status: Analyzed

CVE-2026-5027

Langflow: The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences…

ComponentLangflow
Severityhigh (CVSS 8.8)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published (NVD)2026-03-27
Last modified2026-08-18
Affected versions
< 1.9.0
Fixed in1.9.0
WeaknessCWE-22
CISA KEVnot listed

NVD description

The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').

What to do

  • Upgrade Langflow to 1.9.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more