CVE-2026-33309: 
Homebrew vulnerability analysis and mitigation

CVE-2026-33309 is a critical Arbitrary File Write vulnerability in Langflow (an AI agent/workflow builder) that enables authenticated attackers to write files anywhere on the host filesystem, leading to Remote Code Execution (RCE). It affects Langflow versions 1.2.0 through 1.8.1 and represents a bypass of the prior patch for CVE-2025-68478. The vulnerability was published on March 18, 2026, and a fix was released in version 1.9.0. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, Langflow Advisory).

The root cause is a defense-in-depth failure spanning two layers of the Langflow codebase (CWE-22, CWE-73, CWE-94, CWE-284). In the API layer (src/backend/base/langflow/api/v2/files.py:162), the upload_user_file route extracts the filename directly from the multipart Content-Disposition header (new_filename = file.filename) and passes it verbatim to the storage service — the ValidatedFileName dependency only guards URL path parameters and provides no protection here. In the storage layer (src/backend/base/langflow/services/storage/local.py:114-116), LocalStorageService uses naive path concatenation (file_path = folder_path / file_name) without a resolve().is_relative_to(base_dir) containment check, allowing directory traversal sequences (e.g., ../../) in the filename to escape the intended storage directory. A public PoC Python script demonstrating the full exploit chain is included in the security advisory (GitHub Advisory, Langflow Advisory).

Successful exploitation allows an authenticated attacker to write arbitrary files to any location on the host system, with full confidentiality, integrity, and availability impact and a changed scope. Practical attack outcomes include overwriting .ssh/authorized_keys for persistent SSH access, injecting malicious Python components into the Langflow application to achieve code execution, or overwriting critical system files to disrupt availability. The changed scope means impact can extend beyond the Langflow process itself to the underlying host and any co-located systems (GitHub Advisory, Langflow Advisory).

A functional PoC exploit (a complete, runnable Python script) is publicly available within the GitHub Security Advisory, demonstrating authenticated arbitrary file write against a live Langflow deployment via directory traversal in multipart filenames (Langflow Advisory). Exploitation requires only low-privilege authenticated access (e.g., a standard user account), with no user interaction and low attack complexity. The EPSS score is approximately 0.065% (0.00067), and as of the available data there is no confirmed evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory). The vulnerability has been detected by Qualys (detection ID 5009519) (Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible Langflow instances running versions 1.2.0–1.8.1 using tools like Shodan, Censys, or by checking the Langflow version endpoint.
2. Obtain credentials: Acquire valid Langflow credentials (any authenticated user account suffices — low privilege is enough). This could be via credential stuffing, phishing, or use of default credentials (e.g., admin/admin in test deployments).
3. Authenticate and obtain JWT: Send a POST request to /api/v1/login with valid credentials to retrieve a JWT access token:

   token = requests.post(f"{BASE_URL}/api/v1/login", data={"username": "admin", "password": "admin"}).json()["access_token"]

4. Craft traversal payload: Construct a multipart file upload request to POST /api/v2/files/ with a directory traversal sequence in the Content-Disposition filename field (e.g., ../../traversal_proof.txt or a target such as ../../.ssh/authorized_keys).
5. Upload malicious file: Send the crafted request with the traversal filename and desired file content:

   requests.post(f"{BASE_URL}/api/v2/files/", headers={"Authorization": f"Bearer {token}"}, files={"file": ("../../.ssh/authorized_keys", MALICIOUS_KEY, "text/plain")})

6. Achieve RCE: Depending on the target file written — e.g., overwriting .ssh/authorized_keys enables SSH login, or injecting a malicious Python component into the Langflow plugin directory triggers code execution when the component is loaded (GitHub Advisory, Langflow Advisory).

• Logs: Langflow server logs containing entries like File ../[filename] saved successfully in flow [UUID] — note the ../ prefix indicating traversal; any log entry where the saved filename contains .. or an absolute path outside the expected UUID directory.
• File System: Unexpected files appearing outside the Langflow user storage directories (e.g., /app/data/.cache/langflow/) such as files in parent directories, modified .ssh/authorized_keys, or new/modified Python files in Langflow component directories.
• Network: Authenticated POST requests to /api/v2/files/ where the Content-Disposition header filename contains ../, ..\, or URL-encoded equivalents (%2e%2e%2f); unusual outbound connections from the Langflow server process following file upload activity.
• Process: Unexpected child processes spawned by the Langflow Python process (e.g., shells, curl, wget) following file upload events; new SSH sessions from previously unseen source IPs (GitHub Advisory, Langflow Advisory).

Upgrade Langflow to version 1.9.0 or later, which contains the updated fix addressing the root architectural issue in LocalStorageService (GitHub Advisory). As interim mitigations until patching is complete: restrict network access to the /api/v2/files/ endpoint via firewall or reverse proxy rules; limit Langflow access to trusted, authenticated users only; and implement file system monitoring to detect unauthorized writes outside expected Langflow storage directories. The recommended code-level fix involves sanitizing the multipart filename using pathlib.Path(file.filename).name to strip traversal characters and adding a resolve().is_relative_to(base_dir) containment check in LocalStorageService.save_file (Langflow Advisory).

The vulnerability was covered by SecurityOnline.info as part of a report on critical Langflow vulnerabilities including RCE and file write issues (SecurityOnline). Cyble included it in their weekly vulnerability report for the week of April 1, 2026, and it was also featured in The Hacker News weekly recap for May 2026 alongside other notable vulnerabilities (The Hacker News). Greenbone included it in their May 2026 threat report, indicating continued industry attention to the vulnerability (Greenbone).