CVE-2026-33309: Langflow Arbitrary File Write RCE Flaw

CVE-2026-33309 Overview

CVE-2026-33309 is a critical Path Traversal vulnerability affecting Langflow, a popular tool for building and deploying AI-powered agents and workflows. This vulnerability represents a bypass of the patch for CVE-2025-68478 (External Control of File Name), exposing a root architectural issue within the LocalStorageService component that remained unresolved.

The vulnerability stems from the underlying storage layer lacking boundary containment checks, causing the system to rely entirely on the HTTP-layer ValidatedFileName dependency. This defense-in-depth failure leaves the POST /api/v2/files/ endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, ultimately leading to Remote Code Execution (RCE).

Critical Impact

Authenticated attackers can achieve arbitrary file write and remote code execution on systems running vulnerable Langflow versions by exploiting the POST /api/v2/files/ endpoint through path traversal in multipart upload filenames.

Affected Products

• Langflow versions 1.2.0 through 1.8.1
• Systems with exposed Langflow API endpoints
• AI workflow deployments using vulnerable Langflow installations

Discovery Timeline

• 2026-03-24 - CVE-2026-33309 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33309

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). The flaw exists because the original patch for CVE-2025-68478 only addressed the symptom at the HTTP validation layer without resolving the fundamental architectural weakness in the LocalStorageService.

The LocalStorageService component fails to perform proper boundary containment checks on file paths, meaning any bypass of the front-end validation allows attackers to write files to arbitrary locations on the filesystem. Since the security model depended solely on the ValidatedFileName dependency at the HTTP layer, the multipart upload mechanism provides an alternative attack surface that circumvents this protection entirely.

When exploited, authenticated users can craft malicious filenames in multipart form data that traverse directory boundaries, enabling file writes to sensitive system locations. This can be leveraged to achieve Remote Code Execution by overwriting configuration files, injecting malicious scripts into web-accessible directories, or manipulating application logic files.

Root Cause

The root cause is an incomplete defense-in-depth implementation in Langflow's file handling architecture. The LocalStorageService accepts file paths from upstream components without performing independent path validation or containment checks. The reliance on a single validation point (ValidatedFileName at the HTTP layer) created a single point of failure. When the multipart upload handler passed filenames directly to the storage service, the path-parameter guard was effectively bypassed, exposing the underlying path traversal vulnerability.

Attack Vector

The attack requires network access and authentication to the Langflow API. An authenticated attacker can exploit this vulnerability by:

1. Crafting a malicious HTTP POST request to the /api/v2/files/ endpoint
2. Including a multipart form upload with a specially crafted filename containing path traversal sequences (e.g., ../../../etc/cron.d/malicious)
3. The malicious filename bypasses the path-parameter validation guard
4. The LocalStorageService writes the uploaded content to the attacker-specified location
5. Depending on the target path, this enables RCE through cron jobs, SSH keys, web shells, or other persistence mechanisms

The vulnerability exploits the disconnect between the HTTP-layer validation and the storage service's trust assumptions. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33309

Indicators of Compromise

• Unusual file creation or modification in system directories outside the Langflow data directory
• Web server logs showing POST requests to /api/v2/files/ with filenames containing ../ or encoded path traversal sequences
• New files appearing in sensitive locations such as /etc/cron.d/, ~/.ssh/, or web root directories
• Unexpected cron jobs or scheduled tasks on systems running Langflow

Detection Strategies

• Monitor HTTP access logs for requests to /api/v2/files/ containing path traversal patterns such as ../, ..%2f, or ..%252f
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file writes
• Deploy web application firewall (WAF) rules to block multipart requests with suspicious filename patterns
• Review Langflow application logs for file upload events with paths outside expected directories

Monitoring Recommendations

• Enable verbose logging for the Langflow API to capture complete request details including multipart filenames
• Configure SIEM rules to alert on path traversal patterns in file upload endpoints
• Establish baseline file activity monitoring on Langflow server hosts to detect anomalous file system operations
• Monitor for process execution from unexpected locations that may indicate successful RCE

How to Mitigate CVE-2026-33309

Immediate Actions Required

• Upgrade Langflow to version 1.9.0 or later immediately
• Audit systems running vulnerable versions for signs of compromise, particularly unexpected files in system directories
• Restrict network access to Langflow API endpoints to trusted networks only
• Review and rotate credentials for any accounts with access to the vulnerable endpoint

Patch Information

The vulnerability has been addressed in Langflow version 1.9.0, which contains an updated fix that properly implements boundary containment checks at the storage layer. Organizations should upgrade to this version as soon as possible. The fix is documented in the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, implement a reverse proxy or WAF rule to block requests to /api/v2/files/ containing path traversal sequences in any part of the request
• Restrict filesystem permissions for the Langflow service account to limit the impact of arbitrary file writes
• Consider running Langflow in a containerized environment with strict volume mounts to contain potential file write damage
• Temporarily disable file upload functionality if it is not critical to operations until the patch can be applied

# Example: Restrict Langflow service account permissions
# Create dedicated user with limited filesystem access
useradd -r -s /bin/false langflow-service
chown -R langflow-service:langflow-service /opt/langflow/data
chmod 750 /opt/langflow/data

# Run Langflow with restricted permissions
sudo -u langflow-service langflow run --host 127.0.0.1 --port 7860