Langflow patched unauthenticated file upload in deprecated API endpoint

Langflow disclosed and fixed a vulnerability in the deprecated POST /api/v1/upload/{flow_id} endpoint that allowed unauthenticated users to upload arbitrary amounts of data without effective access control or flow validation. The flaw exposed affected servers to disk space exhaustion and denial-of-service, and the API response also revealed the absolute filesystem path of uploaded files. The issue was demonstrated against commit 2d67402 using any UUID as flow_id, showing that attackers could write data into a flow cache folder even without authorization.

The fix was merged through PR #12831 and released in Langflow 1.9.1, reusing the existing get_flow dependency to require authentication and verify flow ownership on the deprecated route. Maintainers also added file-size enforcement so oversized uploads now return HTTP 413, updated SDK helpers to support API-key authentication, and added regression tests covering unauthenticated rejection, authenticated uploads, oversized file handling, and 401 responses. After the patch, absolute file paths may still be returned, but only to the authenticated owner of the flow.