CVE-2026-33497: Langflow Path Traversal Vulnerability

CVE-2026-33497 Overview

CVE-2026-33497 is a path traversal vulnerability affecting Langflow, a popular tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, the download_profile_picture function in the /profile_pictures/{folder_name}/{file_name} endpoint fails to properly sanitize the folder_name and file_name parameters. This lack of input validation allows attackers to traverse directories and read sensitive files, including the application's secret_key.

Critical Impact

Unauthenticated attackers can exploit this path traversal vulnerability to read arbitrary files on the server, including the Langflow secret key, potentially leading to full application compromise and unauthorized access to AI workflows.

Affected Products

• Langflow versions prior to 1.7.1
• Langflow AI workflow deployments using vulnerable profile picture endpoints
• Self-hosted and cloud-based Langflow installations running unpatched versions

Discovery Timeline

• 2026-03-24 - CVE-2026-33497 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33497

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as a path traversal or directory traversal vulnerability. The flaw exists in the profile picture download functionality where user-controlled input is directly incorporated into file path construction without adequate validation.

The vulnerable endpoint /profile_pictures/{folder_name}/{file_name} accepts two path parameters that are intended to specify profile picture locations. However, the download_profile_picture function does not implement proper input sanitization to prevent directory traversal sequences. An attacker can inject path traversal characters such as ../ to escape the intended directory and access files elsewhere on the filesystem.

The most critical impact of this vulnerability is the ability to read the Langflow secret_key. This secret is typically used for cryptographic operations including session management, token generation, and data encryption. Compromise of this key could allow attackers to forge authentication tokens, decrypt sensitive data, or impersonate legitimate users within the Langflow platform.

Root Cause

The root cause of CVE-2026-33497 is insufficient input validation in the download_profile_picture function. The folder_name and file_name parameters are concatenated into a file path without first validating that they do not contain directory traversal sequences (e.g., ../, ..\\). This allows attackers to manipulate the path to access files outside the intended profile pictures directory.

Proper path canonicalization and validation against a whitelist of allowed directories were not implemented, enabling the traversal attack. The function should verify that the resolved path remains within the designated profile pictures directory before serving any files.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can craft a malicious HTTP request to the vulnerable endpoint, substituting legitimate folder and file names with directory traversal payloads.

For example, an attacker could target the endpoint with a request containing ../ sequences in the path parameters to navigate to parent directories and ultimately read configuration files containing the secret key. The vulnerability is particularly dangerous because it provides direct access to cryptographic material that could be used to further compromise the application.

Since no authentication is required, any network attacker with access to the Langflow instance can exploit this vulnerability. The attack complexity is low, making it accessible to attackers with minimal technical sophistication.

Detection Methods for CVE-2026-33497

Indicators of Compromise

• HTTP requests to /profile_pictures/ containing ../ or encoded traversal sequences (%2e%2e%2f)
• Unusual access patterns to the profile pictures endpoint from external IP addresses
• Log entries showing attempts to read files outside the profile pictures directory
• Access attempts targeting known sensitive files such as configuration files or secret key locations

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in URL parameters
• Monitor web server access logs for requests containing directory traversal sequences
• Deploy file integrity monitoring on sensitive configuration files to detect unauthorized access
• Configure intrusion detection systems (IDS) to alert on suspicious file read operations from the web application process

Monitoring Recommendations

• Enable detailed access logging for the Langflow application to capture all requests to the profile pictures endpoint
• Set up alerts for any 200 OK responses to requests containing suspicious path characters
• Monitor for anomalous network traffic patterns indicating reconnaissance or exploitation attempts
• Review authentication logs for signs of forged sessions that might indicate secret key compromise

How to Mitigate CVE-2026-33497

Immediate Actions Required

• Upgrade Langflow to version 1.7.1 or later immediately to receive the security patch
• Rotate the Langflow secret_key if you suspect the vulnerability may have been exploited
• Review access logs for evidence of exploitation attempts prior to patching
• Temporarily restrict network access to vulnerable Langflow instances if immediate patching is not possible

Patch Information

Langflow has released version 1.7.1 which contains a patch for this vulnerability. Users should upgrade to this version or later to remediate the path traversal flaw. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-ph9w-r52h-28p7.

Workarounds

• Implement a reverse proxy or WAF rule to filter requests containing path traversal sequences before they reach the Langflow application
• Restrict network access to the Langflow instance using firewall rules, limiting exposure to trusted networks only
• Disable or remove the profile pictures functionality if it is not required for your deployment
• Apply network segmentation to isolate Langflow instances from sensitive internal resources

# Example WAF rule to block path traversal attempts (nginx)
location /profile_pictures/ {
    if ($request_uri ~* "\.\.") {
        return 403;
    }
    # Additional security headers
    add_header X-Content-Type-Options "nosniff";
    add_header X-Frame-Options "DENY";
}