CVE-2026-51888
Low risk· EPSS 13%Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Directory Traversal vulnerability in langflow up to 1.8.4. Through the knowledge base creation endpoint, an attacker can write or overwrite files outside the intended working directory using absolute paths.
Risk Assessment
An attacker can write or overwrite arbitrary files on the server, potentially leading to application modification, takeover, or data integrity compromise.
Recommendation
Update langflow to the latest patched version. Additionally, restrict access to the knowledge base creation endpoint and validate file paths.
Other vulnerabilities in langflow
See all- CVE-2026-34046High
Langflow prior to version 1.5.1 had a security vulnerability that allowed authenticated users to access other users' flows without ownership checks. The issue stemmed from the lack of proper query filtering based on the `AUTO_LOGIN` setting.
- CVE-2026-55450Critical
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.1, unauthenticated users can upload unlimited amounts of data to the server, leading to space exhaustion. Additionally, the server response reveals the absolute path of the uploaded file, which constitutes an information leak.
- CVE-2026-55255HighActively exploited
In Langflow prior to 1.9.1, an IDOR vulnerability in the /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
- CVE-2026-42048Critical
Langflow, a tool for building and deploying AI agents, is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases) prior to version 1.9.0. An attacker can exploit this flaw to delete arbitrary directories on the server.
- CVE-2026-33017CriticalActively exploited
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allowed building public flows without requiring authentication, leading to the possibility of remote code execution by unauthorized users.
- CVE-2026-0770CriticalActively exploited
A vulnerability in Langflow allows remote code execution via the exec_globals parameter in the validate endpoint. An unauthenticated attacker can inject malicious code from an untrusted source.
- CVE-2026-21445Critical
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.
- CVE-2025-34291HighActively exploited
A vulnerability in Langflow versions up to and including 1.6.9 enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie set as SameSite=None allows a malicious webpage to perform cross-origin requests with credentials and call the refresh endpoint. An attacker can obtain fresh access_token/refresh_token pairs for a victim session and use them to execute arbitrary code, leading to full system compromise.
- CVE-2025-3248CriticalActively exploited
Langflow versions prior to 1.3.0 are vulnerable to code injection via the /api/v1/validate/code endpoint. An unauthenticated remote attacker can execute arbitrary code by sending crafted HTTP requests.
- CVE-2026-51886Low risk· EPSS 6%
Code Injection vulnerability in langflow up to 1.9.3. An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which executes code without sandboxing.
Original NVD description (English source)
langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is: src/backend/base/langflow/api/v1/knowledge_bases.py:knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge-base. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing upload or HTTP route handler forwards an attacker-controlled path or filename into host file creation without any visible boundary enforcement. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.8.4. langflow contains an absolute path traversal vulnerability in knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge-base (src/backend/base/langflow/api/v1/knowledge_bases.py:51). An attacker can write or overwrite files outside the intended working directory by providing absolute paths in the knowledge base creation endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS