Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName` dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through
    1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root
    architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage
    layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName`
    dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to
    Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing
    authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution
    (RCE). Version 1.9.0 contains an updated fix. (CVE-2026-33309)

According to its banner, the version of Langflow running on the remote host is prior to 1.9.0. It is, therefore, affected by a multiples vulnerabilities :

- An Authenticated Code Execution in agentic assistant validation

- An Unauthenticated Remote Code Execution via public flow build endpoint

- A Path Traversal in knowledge bases API via bulk delete endpoint

- An Arbitrary File Write (RCE) through the V2 API

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
464410	Echo: langflow: security update to 1.9.0	Tenable Cloud Security	Echo Local Security Checks	Local	critical
464410	Echo: langflow: security update to 1.9.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
115277	Langflow < 1.9.0 Multiples Vulnerabilities	Web App Scanning	Artificial Intelligence	Version Based	critical
439247	SCA: security update for langflow (GHSA-g2j9-7rj2-gm6c)	Tenable Cloud Security	SCA Checks	Local	critical
439247	SCA: security update for langflow (GHSA-g2j9-7rj2-gm6c)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-33309

critical

Tenable Plugins

critical

critical

critical

critical

critical