Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| langflow | pip | >= 1.2.0, < 1.9.0 | 1.9.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is an Arbitrary File Write, which can lead to Remote Code Execution (RCE), in the /api/v2/files/ endpoint. The root cause is a lack of input sanitization and path containment checks across two layers of the application.
API Layer (upload_user_file function): The upload_user_file function in src/backend/base/langflow/api/v2/files.py directly uses the filename provided by the user in the Content-Disposition header of a multipart file upload. It does not sanitize or validate this filename for path traversal characters (../), allowing a malicious path to be passed to the next layer.
Storage Layer (LocalStorageService.save_file method): The save_file method in src/backend/base/langflow/services/storage/local.py receives the unsanitized filename and constructs the final file path by naively concatenating it with the base storage directory. It fails to perform a critical containment check to ensure the resolved path is within the intended directory.
An authenticated attacker could exploit this by sending a POST request to /api/v2/files/ with a crafted filename like ../../../../tmp/pwned.txt. The upload_user_file function would accept this filename, and LocalStorageService.save_file would write the file to /tmp/pwned.txt on the server, outside of the user's designated storage area. This allows for overwriting critical system files, injecting code, or other actions leading to RCE.
The patch addresses this by adding strict filename validation in upload_user_file and a defense-in-depth path containment check in LocalStorageService.save_file using is_relative_to() to ensure the final path is secure.
