Loading vulnerability…
Arbitrary File Write Leading to RCE in Langflow v2 File Upload
CVE-2026-33309 is an authenticated path traversal vulnerability affecting Langflow versions 1.2.0 through 1.8.1. It bypasses the fix for CVE-2025-68478 because LocalStorageService lacks storage-layer boundary containment checks and relies on the HTTP-layer ValidatedFileName dependency. Attacker-controlled multipart upload filenames evade the path-parameter validation, allowing files to be written outside the intended storage directory. Arbitrary file writes can lead to remote code execution. Langflow 1.9.0 contains an updated fix.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated attacker can write attacker-controlled files outside Langflow's intended storage directory, subject to the service process's filesystem permissions. This can enable overwriting critical files, injecting malicious Python components, modifying SSH authorization, and ultimately executing code on the host. Successful code execution can compromise application-accessible secrets and data, alter application behavior, and disrupt service availability. Exploitation activity matching this vulnerability has been observed, and VulnCheck has included it in its Known Exploited Vulnerabilities catalog.
If you can’t patch tonight, do this now.
Until an upgrade is possible, sanitize multipart upload filenames by stripping directory components and rejecting traversal patterns or otherwise invalid names. Enforce resolve()-based path containment checks in the storage layer. Remove public internet exposure and restrict network access to trusted clients. These measures are interim protections, not substitutes for installing the fixed release.
Patch, then assume compromise.
Upgrade Langflow and related packages to version 1.9.0 or later, which includes the fix for this vulnerability. For maintained implementations, enforce canonical path containment in LocalStorageService.save_file so resolved destination paths cannot escape the intended storage directory; do not rely exclusively on HTTP-layer filename validation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.