A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function
    create_upload_file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API
    Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack remotely.
    The exploit has been released to the public and may be used for attacks. The vendor was contacted early
    about this disclosure but did not respond in any way. (CVE-2026-6596)

ID	Name	Product	Family	Type	Severity
459260	Echo: langflow-base: security update to 0.9.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459260	Echo: langflow-base: security update to 0.9.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
443501	SCA: security update for langflow-base (GHSA-vvfc-fp59-m92g)	Tenable Cloud Security	SCA Checks	Local	medium
443501	SCA: security update for langflow-base (GHSA-vvfc-fp59-m92g)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-6596

medium

Tenable Plugins

medium

medium

medium

medium