Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-33309 is a critical Arbitrary File Write vulnerability in the langflow package versions 1.2.0 through 1.8.1. It arises because the LocalStorageService component does not properly check file path boundaries, allowing an attacker to bypass filename validation.'}, {'type': 'paragraph', 'content': 'Specifically, the vulnerability exists in the POST /api/v2/files/ API endpoint, where the filename from a multipart upload is taken directly from the Content-Disposition header without sanitization. This allows an authenticated attacker to submit filenames containing directory traversal sequences (e.g., "../../") to write files outside the intended storage directory.'}, {'type': 'paragraph', 'content': 'This flaw leads to the possibility of writing arbitrary files anywhere on the host system, including overwriting critical system files or injecting malicious code, ultimately enabling Remote Code Execution (RCE).'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows authenticated attackers to write arbitrary files anywhere on the host system.

• Attackers can overwrite critical system files, potentially destabilizing or compromising the system.
• Malicious Python code can be injected, leading to Remote Code Execution (RCE), which means attackers can execute arbitrary commands on the host.
• Attackers can overwrite sensitive files such as .ssh/authorized_keys, enabling persistent unauthorized access.

Overall, this vulnerability poses a critical security risk with a CVSS v3.1 base score of 9.9, indicating high impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring attempts to exploit the POST /api/v2/files/ endpoint with multipart uploads containing filenames that include directory traversal sequences such as "../".'}, {'type': 'paragraph', 'content': 'A practical detection method is to inspect server logs or network traffic for file upload requests where the filename parameter contains path traversal patterns.'}, {'type': 'paragraph', 'content': 'For example, you can use the following command to search server logs for suspicious filenames:'}, {'type': 'list_item', 'content': "grep -E '\\.\\./|\\.\\.\\\\' /path/to/langflow/logs/access.log"}, {'type': 'paragraph', 'content': 'Additionally, a proof of concept Python script exists that authenticates to the API and uploads a file with a traversal filename to confirm the vulnerability.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation steps include upgrading Langflow to version 1.9.0 or later, which contains the updated fix for this vulnerability.

If upgrading is not immediately possible, apply the following mitigations:

• Sanitize the multipart upload filenames by stripping directory traversal characters before processing. For example, use code to extract only the base filename and reject invalid names.
• Add a canonical path containment check inside the LocalStorageService.save_file method to ensure the resolved file path is within the allowed base directory.

These steps prevent arbitrary file writes and mitigate the risk of remote code execution via this vulnerability.

Useful 0 Not Useful 0