CVE-2026-33497: 
Homebrew vulnerability analysis and mitigation

CVE-2026-33497 is a path traversal vulnerability in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The flaw exists in the download_profile_picture function at the /api/v1/files/profile_pictures/{folder_name}/{file_name} endpoint, where unsanitized path parameters allow unauthenticated attackers to read arbitrary files — including the application's JWT signing secret_key — from the server filesystem. All Langflow versions prior to 1.7.1 are affected. It was disclosed on March 20, 2026, with a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Langflow Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), classified as a path traversal vulnerability. In src/backend/base/langflow/api/v1/files.py, the download_profile_picture function directly concatenated user-supplied folder_name and file_name parameters into a filesystem path without sanitization or boundary validation, and the prior boundary check used a startswith() string comparison that was susceptible to prefix-ambiguity bypasses. An unauthenticated attacker can supply traversal sequences such as ../secret_key in the URL path to escape the intended profile_pictures directory and read any file accessible to the application process. No authentication or special privileges are required, and the attack is executable with a single HTTP GET request (GitHub Advisory, Langflow Advisory).

Successful exploitation enables unauthenticated disclosure of any file readable by the Langflow application process, with the most critical target being the secret_key file used to sign all JWT authentication tokens. An attacker who obtains the secret_key can forge valid JWT tokens and authenticate as any user, including administrators, effectively achieving full authentication bypass and administrative takeover of the Langflow instance. This can lead to unauthorized access to AI workflows, sensitive data processed by agents, and potential lateral movement within the deployment environment (GitHub Advisory).

A public proof-of-concept exploit is available in the official security advisory, consisting of a single curl command: curl --path-as-is 'http://<host>:7860/api/v1/files/profile_pictures/../secret_key'. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any network-accessible attacker. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.014% (16th percentile). The vulnerability was detected by Qualys (detection ID 5009522) (Langflow Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Langflow instances (default port 7860) using tools like Shodan, Censys, or network scanning. Confirm the instance is running a version prior to 1.7.1.
2. Craft traversal request: Construct a GET request targeting the vulnerable endpoint with path traversal sequences, e.g., GET /api/v1/files/profile_pictures/../secret_key.
3. Send request with path-as-is flag: Use curl --path-as-is 'http://<host>:7860/api/v1/files/profile_pictures/../secret_key' to prevent the HTTP client from normalizing the traversal sequences before sending.
4. Extract secret_key: A successful response returns the raw secret_key value used to sign all JWT tokens for the Langflow instance.
5. Forge JWT tokens: Using the extracted secret_key, craft a valid JWT token with administrator-level claims using tools such as jwt_tool or custom scripts.
6. Authenticate as administrator: Use the forged JWT token in subsequent API requests to authenticate as any user, including administrators, and gain full control of the Langflow instance (Langflow Advisory, GitHub Advisory).

• Network: Unusual HTTP GET requests to /api/v1/files/profile_pictures/ containing .. or URL-encoded traversal sequences (e.g., %2e%2e, %2F) in the path; requests from unexpected or external IP addresses to port 7860.
• Logs: Web server or application access logs showing GET requests to /api/v1/files/profile_pictures/../secret_key or similar traversal paths; HTTP 200 responses to such requests indicating successful file reads.
• File System: Unexpected access timestamps on the secret_key file in the Langflow configuration directory.
• Authentication: Unusual JWT-authenticated sessions appearing without corresponding login events, particularly with administrator privileges, which may indicate forged token usage following secret_key exfiltration (Langflow Advisory).

Upgrade Langflow to version 1.7.1 or later, which introduces two layers of defense: typed path validation (ValidatedFolderName and ValidatedFileName annotated types) that reject traversal characters at the FastAPI input layer, and a Path.is_relative_to() containment check replacing the vulnerable startswith() comparison. If immediate upgrade is not possible, restrict network access to the /api/v1/files/profile_pictures/ endpoint at the reverse-proxy or firewall level. Additionally, rotating the secret_key is strongly recommended if exposure cannot be ruled out, as any previously exposed key should be considered compromised (GitHub Advisory, Langflow Advisory).

The vulnerability was responsibly disclosed by security researcher r00tuser111 and acknowledged by the Langflow team. The advisory was published by AntonioABLima on March 20, 2026. The issue received coverage from automated vulnerability tracking platforms including VulDB, CIRCL, and CVEFeed, as well as a mention on Mastodon via TheHackerWire. Check Point also published a defense advisory (CPAI-2026-4976) referencing this CVE (Langflow Advisory).