CVE-2026-48520: Langflow Path Traversal Vulnerability

CVE-2026-48520 Overview

CVE-2026-48520 is an arbitrary file-read vulnerability in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The flaw affects the Shareable Playground feature (referenced as Public Flows in code) in versions prior to 1.10.0. When a flow is made public, the execution request accepts a list of file paths that Langflow reads and passes into the underlying large language model (LLM). The file path can target any location supported by the configured storage backend, including local filesystem paths and S3 buckets. The issue is tracked under CWE-73: External Control of File Name or Path.

Critical Impact
An unauthenticated remote attacker can coerce Langflow into reading arbitrary files accessible to the application and exfiltrating their contents through LLM responses.

Affected Products

Langflow versions prior to 1.10.0
Deployments exposing the Shareable Playground or Public Flows feature
Instances using local filesystem or S3 storage backends

Discovery Timeline

2026-06-23 - CVE-2026-48520 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in the NVD database

Technical Details for CVE-2026-48520

Vulnerability Analysis

Langflow allows users to expose individual flows publicly through the Shareable Playground feature. Once a flow is published, anyone with the link can invoke it without authentication. The execution endpoint accepts a list of file references that Langflow loads from its configured storage backend before passing the contents to the LLM step in the flow. The application does not constrain these file references to the user's workspace or to safe directories.

Because attacker-controlled input flows directly into a storage read operation, the request can reference arbitrary paths such as application secrets, configuration files, or objects in connected S3 buckets. The LLM then echoes or summarizes those contents in its response, providing a readable exfiltration channel. The vulnerability requires user interaction in the form of executing the public flow, which limits worm-style abuse but does not prevent targeted attacks.

Root Cause

The root cause is missing path validation in the public flow execution handler. File path arguments supplied by unauthenticated callers are forwarded to the storage layer without normalization, allow-listing, or authorization checks tied to the flow owner.

Attack Vector

The vulnerability is exploited over the network against any Langflow instance that has at least one flow marked public. An attacker submits a crafted execution request that supplies file paths, such as local paths to credentials files or S3 object keys, in the file input parameter. Langflow reads the targeted file and forwards its contents to the configured LLM, which returns the data in the flow output.

No verified proof-of-concept code has been published. Technical details are available in the GitHub Security Advisory GHSA-rcjh-r59h-gq37.

Detection Methods for CVE-2026-48520

Indicators of Compromise

Public flow execution requests whose file parameters reference paths outside the Langflow data directory, such as /etc/, /root/, or ~/.aws/.
S3 GetObject calls from the Langflow service account targeting buckets or prefixes unrelated to normal flow operation.
LLM responses in flow logs containing fragments of configuration files, private keys, or environment variables.

Detection Strategies

Enable verbose request logging on the Langflow API and alert on file path parameters containing traversal sequences or absolute paths to sensitive locations.
Correlate public flow executions with subsequent file reads on the host using endpoint or container runtime telemetry.
Review historical access logs from any S3 bucket reachable by Langflow for unexpected reads originating from the Langflow workload identity.

Monitoring Recommendations

Track the count and source IP distribution of requests to public flow endpoints, alerting on sudden spikes from unfamiliar networks.
Monitor Langflow process file descriptors and syscalls for reads of files outside its working directory.
Audit which flows are marked public and review their inputs and components on a recurring schedule.

How to Mitigate CVE-2026-48520

Immediate Actions Required

Upgrade Langflow to version 1.10.0 or later, where this vulnerability is fixed.
Disable or unpublish any Shareable Playground or Public Flows until the upgrade is complete.
Rotate credentials, API keys, and tokens that were readable by the Langflow process if public flows were exposed to the internet.

Patch Information

The maintainers fixed the issue in Langflow 1.10.0. Refer to the GitHub Security Advisory GHSA-rcjh-r59h-gq37 for the patch details and upgrade guidance.

Workarounds

Place Langflow behind an authenticating reverse proxy and block unauthenticated access to public flow endpoints.
Run Langflow under a least-privilege service account with no access to host secrets, and restrict its S3 IAM role to specific prefixes.
Remove file input components from any flow that must remain public until the upgrade is applied.

bash

# Upgrade Langflow to the patched release
pip install --upgrade "langflow>=1.10.0"

# Verify the installed version
python -c "import langflow; print(langflow.__version__)"