Loading vulnerability…
Langflow File Upload Path Traversal Leading to Remote Code Execution
CVE-2026-5027 is a path traversal vulnerability in Langflow's file upload handler. The handler accepts an attacker-controlled filename from multipart form data and passes it to the storage service without adequately validating traversal sequences. Combining this filename with the storage directory allows uploaded data to be written outside the intended location, subject to the application's filesystem permissions. Arbitrary file writes can lead to remote code execution by placing files where server-side mechanisms subsequently execute them. Although the endpoint requires a session, Langflow's default unauthenticated auto-login permits attackers to obtain a valid session token without credentials. The vulnerability is actively exploited.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises filesystem integrity and can lead to remote code execution, persistence, credential theft, and unauthorized remote access. Attackers can place executable scheduled tasks or SSH authorization material where filesystem permissions and host configuration permit. Compromise can expose credentials and sensitive information accessible to Langflow, including connected AI-provider and cloud-service credentials. Observed exploitation of this vulnerability included deployment of a Python credential harvester, proxy agents, and SimpleHelp remote-access software. Execution privileges depend on the affected deployment and the mechanism used to execute attacker-written files; root access is not an inherent consequence.
If you can’t patch tonight, do this now.
Disable unauthenticated auto-login by setting LANGFLOW_AUTO_LOGIN=false and enforce authentication. This reduces unauthenticated exposure but does not correct the arbitrary-file-write flaw for authenticated attackers. Restrict Langflow access to trusted internal networks or VPNs and remove unnecessary public exposure. Monitor multipart uploads for raw or encoded filename traversal sequences, unexpected writes outside application storage, changes to scheduled tasks, and anomalous outbound connections.
Patch, then assume compromise.
Upgrade Langflow to version 1.10.0 or a newer supported release. Fixes are also identified in Langflow 1.9.0 and langflow-base 0.8.3; ensure the deployed application and underlying package both contain the correction. On potentially compromised systems, investigate unauthorized file writes, scheduled tasks, SSH authorization changes, credential-harvesting tools, proxy agents, and remote-access software. Remove unauthorized persistence and rotate credentials exposed to the compromised service.
7 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
101 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.