CVE-2026-48520

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration This vulnerability is fixed in 1.10.0.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/langflow-ai/langflow/security/advisories/GHSA-rcjh-r59h-gq37	Exploit Vendor Advisory
https://github.com/langflow-ai/langflow/security/advisories/GHSA-rcjh-r59h-gq37	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Langflow es una herramienta para construir y desplegar agentes y flujos de trabajo impulsados por IA. Antes de 1.10.0, el ’Shareable Playground’ (o ’Public Flows’ en el código) contiene una potencial vulnerabilidad de lectura arbitraria de archivos, dependiendo de la configuración exacta del flujo utilizada. Al hacer público un flujo, se permite la ejecución pública del flujo. La solicitud de ejecución puede contener una lista de archivos que son leídos por Langflow y alimentados al LLM. La ruta de los archivos puede ser cualquier ruta compatible con el almacenamiento - puede ser un archivo local o una ruta S3 si es compatible con la configuración local. Esta vulnerabilidad está corregida en 1.10.0.

Information

Published : 2026-06-23 17:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-48520

Mitre link : CVE-2026-48520

CVE.ORG link : CVE-2026-48520

JSON object : View

Products Affected

langflow

langflow

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-48520", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48520", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T14:18:15.520520Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "langflow-ai", "product": "langflow", "versions": [{"status": "affected", "version": "< 1.10.0"}]}]}], "published": "2026-06-23T17:17:01.367", "references": [{"url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-rcjh-r59h-gq37", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-rcjh-r59h-gq37", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the \"Shareable Playground\" (or \"Public Flows\" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration This vulnerability is fixed in 1.10.0."}, {"lang": "es", "value": "Langflow es una herramienta para construir y desplegar agentes y flujos de trabajo impulsados por IA. Antes de 1.10.0, el \u2019Shareable Playground\u2019 (o \u2019Public Flows\u2019 en el c\u00f3digo) contiene una potencial vulnerabilidad de lectura arbitraria de archivos, dependiendo de la configuraci\u00f3n exacta del flujo utilizada. Al hacer p\u00fablico un flujo, se permite la ejecuci\u00f3n p\u00fablica del flujo. La solicitud de ejecuci\u00f3n puede contener una lista de archivos que son le\u00eddos por Langflow y alimentados al LLM. La ruta de los archivos puede ser cualquier ruta compatible con el almacenamiento - puede ser un archivo local o una ruta S3 si es compatible con la configuraci\u00f3n local. Esta vulnerabilidad est\u00e1 corregida en 1.10.0."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21C0B298-2258-4F78-9DB9-9DA89089EE4F", "versionEndExcluding": "1.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}