What is the CVSS score of CVE-2026-33497?

CVE-2026-33497 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-33497?

Yes, a public proof-of-concept exploit is available for CVE-2026-33497. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-33497?

Within 24 hours: Inventory all systems running Langflow and assess exposure scope; isolate affected instances from production if possible. Within 7 days: Implement network-level controls (WAF rules, IP restrictions) to block the vulnerable endpoint; rotate all JWT secrets and API keys; apply input validation at the application layer. Within 30 days: Migrate to a patched version when available; conduct forensic audit for unauthorized token generation; review access logs for exploitation attempts.

CVE-2026-33497

HIGH

Path Traversal (CWE-22)

2026-03-20 https://github.com/langflow-ai/langflow

GHSA-ph9w-r52h-28p7

Path Traversal

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 24, 2026 - 19:20 vuln.today

Public exploit code

Analysis Generated

Mar 20, 2026 - 21:01 vuln.today

CVE Published

Mar 20, 2026 - 20:56 nvd

HIGH 7.5

DescriptionGitHub Advisory

Summary

In the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories.

Details

src/backend/base/langflow/api/v1/files.py

!image

storage local get_file, directly concatenate flow_id and file_name !image

PoC

curl --path-as-is 'http://127.0.0.1:7860/api/v1/files/profile_pictures/../secret_key' ```

Impact

secret_key is used for jwt authentication. Attackers can forge authentication tokens and log into the system.

AnalysisAI

Path traversal in Langflow's /profile_pictures endpoint allows unauthenticated remote attackers to read the application's secret_key through directory traversal in the folder_name parameter. Since the secret_key is used for JWT authentication, attackers can forge valid tokens to gain unauthorized system access. Public exploit code exists for this vulnerability and no patch is currently available.

Technical ContextAI

Langflow is a Python-based low-code application builder for LangChain workflows, distributed as a pip package (pkg:pip/langflow). The vulnerability exists in the download_profile_picture function within src/backend/base/langflow/api/v1/files.py, where the folder_name and file_name parameters lack proper input validation. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability, where unsanitized user input is directly concatenated into file path operations. The storage.local.get_file method combines flow_id and file_name without canonicalization or path traversal filtering, allowing attackers to use directory traversal sequences like '../' to escape the intended profile_pictures directory and access sensitive files such as the JWT secret_key stored in the application's file system.

RemediationAI

Immediately upgrade Langflow to the patched version specified in the GitHub security advisory at https://github.com/langflow-ai/langflow/security/advisories/GHSA-ph9w-r52h-28p7 or the corresponding National Vulnerability Database advisory at https://github.com/advisories/GHSA-ph9w-r52h-28p7. The fix should implement strict input validation on folder_name and file_name parameters, rejecting any path traversal sequences and canonicalizing file paths before file system operations. Until patching is completed, implement immediate mitigations including restricting network access to the /api/v1/files endpoint to authenticated users only via reverse proxy rules, deploying web application firewall rules to block requests containing '../' or encoded traversal sequences in the profile_pictures path, rotating the existing secret_key to invalidate any previously exfiltrated tokens, and monitoring authentication logs for suspicious JWT token usage patterns. If Langflow is exposed to untrusted networks, consider temporarily disabling the profile picture functionality entirely until patches are applied.