Loading vulnerability…
Unauthenticated path traversal in Langflow profile-picture downloads
CVE-2026-33497 is an unauthenticated path traversal vulnerability affecting Langflow versions before 1.7.1. The download_profile_picture function insufficiently validates attacker-controlled folder and file parameters when constructing a download path, allowing traversal outside the intended profile-picture directory. Attackers can retrieve files readable by the application process, including its authentication signing key. Disclosure of that key enables forging valid authentication tokens, including administrator tokens. Proof-of-concept testing demonstrated successful key retrieval against version 1.6.9 and rejection of the traversal request against version 1.7.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation exposes arbitrary files within the application process's read permissions. Theft of the JWT signing key enables authentication bypass and impersonation of accounts, including administrators. Resulting account access can potentially expose connected model API credentials, internal knowledge bases, database connectors, and workflows. Exploitation-pattern requests have been observed, but successful compromises and signing-key disclosure in those observations were not confirmed.
If you can’t patch tonight, do this now.
Until upgrading, block access to the profile-picture download endpoint at a reverse proxy or other appropriate access-control layer. Remove direct internet exposure by placing Langflow behind a VPN or identity-aware proxy. Generic traversal filtering can provide an interim control, but request filtering and source-address blocking do not replace patching or signing-key rotation.
Patch, then assume compromise.
Upgrade Langflow to version 1.7.1 or later, preferably a current supported release, and verify the installed version. Version 1.7.1 patches the traversal vulnerability; additional path-validation and containment hardening was reported in version 1.9.0. If exposure cannot be ruled out, rotate the authentication signing key and force re-authentication. Patching alone does not invalidate tokens forged with a stolen key.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.