CVE-2026-33309

The core of this vulnerability lies in the LocalStorageService component, which lacks proper boundary containment checks. This reliance on the HTTP-layer ValidatedFileName dependency creates a defense-in-depth failure. Attackers can exploit the /api/v2/files/ endpoint through a multipart upload filename bypass, effectively circumventing path-parameter guards. This allows for arbitrary file writing, meaning an attacker can write malicious files to the server, potentially overwriting critical system files or injecting malicious code. Successful exploitation could lead to complete system compromise, including data exfiltration, denial of service, and the execution of arbitrary commands with the privileges of the Langflow process. The impact is particularly severe given Langflow's role in building and deploying AI agents, which often handle sensitive data and interact with external systems.

Organizations deploying Langflow for AI agent development and workflow automation are at significant risk. This includes teams using Langflow in production environments, particularly those with limited security controls or those relying on older, unpatched versions. Shared hosting environments where multiple users share the same Langflow instance are also at elevated risk, as a compromise of one user's environment could potentially impact others.

• python / server:

import os
import hashlib

def check_langflow_files(directory):
    for filename in os.listdir(directory):
        if filename.endswith('.pyc') or filename.endswith('.pyo'):
            file_path = os.path.join(directory, filename)
            try:
                with open(file_path, 'rb') as f:
                    file_content = f.read()
                md5_hash = hashlib.md5(file_content).hexdigest()
                if 'malicious_string' in md5_hash:
                    print(f"Potential malicious file detected: {file_path}")
            except Exception as e:
                print(f"Error reading file: {file_path} - {e}")

# Example usage (replace with Langflow's data directory)
check_langflow_files('/path/to/langflow/data')

• generic web:

curl -I 'http://your-langflow-server/api/v2/files/' | grep 'Content-Type:'

• linux / server:

journalctl -u langflow -f | grep -i "error" -i "exception"

1. 2026-03-19Disclosure

   disclosure

2. 2026-03-19Patch

   patch

1. Reserviert2026-03-18
2. Veröffentlicht2026-03-19
3. Geändert2026-03-25
4. EPSS aktualisiert2026-04-01

The primary mitigation for CVE-2026-33309 is to immediately upgrade Langflow to version 1.9.0 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Strictly validate all file uploads, implementing robust input sanitization and whitelisting of allowed filenames. Consider using a Web Application Firewall (WAF) with rules to block suspicious multipart upload requests, particularly those attempting to write files outside of designated directories. Monitor Langflow logs for unusual file creation or modification activity, focusing on the /api/v2/files/ endpoint. After upgrading, confirm the fix by attempting a file upload with a deliberately malicious filename and verifying that the upload is rejected.