PT-2026-33691 · Langflow Ai · Langflow

Eric-D · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6596

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.1.1

Description An unrestricted file upload flaw exists in the API Endpoint component. The issue is located in the create upload file() function within the file 'src/backend/base/Langflow/api/v1/endpoints.py'. This allows a remote attacker to upload files without proper restrictions. Over 2,900 internet-facing instances have been identified as potentially exposed.

Recommendations Update to a version later than 1.1.0. As a temporary workaround, restrict access to the create upload file() function until a patch is applied.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2026-6596

GHSA-VVFC-FP59-M92G

Affected Products

Langflow

References · 9

• 🔥 https://gist.github.com/chenhouser2025/c2aabfdee41009cfe45d28a9924742a0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6596 · Security Note
• https://osv.dev/vulnerability/GHSA-vvfc-fp59-m92g · Vendor Advisory
• https://github.com/langflow-ai/langflow/commit/b5662446bc8c54d928e278d3d26ad95b62425815 · Note
• https://twitter.com/VulmonFeeds/status/2046075170444521496 · Twitter Post
• https://vuldb.com/vuln/358231/cti · Note
• https://vuldb.com/submit/791919 · Note
• https://twitter.com/fofabot/status/2046148165447946656 · Twitter Post
• https://vuldb.com/vuln/358231 · Note