EUVD-2026-23745
GHSA-vvfc-fp59-m92g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unrestricted file upload in Langflow (langflow-ai) versions up to 1.1.0 allows remote unauthenticated attackers to upload arbitrary files via the create_upload_file API endpoint, potentially leading to remote code execution, data manipulation, and service disruption. Publicly available exploit code exists (CVSS:3.1 E:P) with GIST-hosted POC, elevating immediate risk. Vendor unresponsive to disclosure at time of publication.
Technical ContextAI
This vulnerability exploits CWE-434 (unrestricted upload of file with dangerous type) in Langflow, an AI workflow and chatbot building framework. The flaw resides in the create_upload_file function within the API endpoint handler (src/backend/base/Langflow/api/v1/endpoints.py). Langflow's API likely lacks proper validation of file types, extensions, content inspection, or storage location controls during upload operations. The affected component is cpe:2.3:a:langflow-ai:langflow:*:*:*:*:*:*:*:* up to version 1.1.0. Unrestricted upload vulnerabilities in API endpoints commonly enable attackers to upload malicious scripts (Python .py files, shell scripts, web shells) that execute server-side, bypass authentication mechanisms, or overwrite critical application files. Given Langflow's Python-based backend, uploaded .py files could be executed in the application context if served from an executable directory or triggered by application logic.
RemediationAI
No vendor-released patch is available at time of analysis (CVSS RL:X indicates vendor unresponsive). IMMEDIATE compensating controls required: (1) Block external access to /api/v1/endpoints.py routes or the entire Langflow API using firewall rules, reverse proxy ACLs (nginx/Apache), or API gateway policies-restricts attack surface but breaks legitimate API integrations. (2) Implement strict Content-Type validation and file extension allowlisting in a WAF or reverse proxy layer (e.g., ModSecurity rules blocking executable extensions: .py, .sh, .exe, .php)-may cause false positives for legitimate workflows requiring script uploads. (3) Deploy Langflow behind VPN or zero-trust access controls limiting access to authenticated users from known IP ranges-reduces usability for external integrations. (4) Monitor for unauthorized file creation in upload directories and web server logs for POST requests to create_upload_file endpoint. (5) Consider migrating to containerized deployment with read-only filesystem mounts for application code directories to prevent uploaded files from overwriting critical components-requires infrastructure changes. Exploit code available at https://gist.github.com/chenhouser2025/c2aabfdee41009cfe45d28a9924742a0 can inform detection signatures. Track langflow-ai GitHub repository for community patches or forks addressing CVE-2026-6596.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Arbitrary file write vulnerability in an API endpoint (POST /api/v2/files) enables authenticated remote attackers to ove
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today