CVE-2026-55447
published 2026-06-23CVE-2026-55447: Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an…
PriorityP354critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.41%
32.8th percentile
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| langflow-ai | langflow | < 1.9.2 | 1.9.2 |
| langflow | langflow | < 1.9.2 | 1.9.2 |
| langflow | langflow | >= 0 < 1.9.2 | 1.9.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
langflow-ai langflow up to 1.9.1 symlink (GHSA-ccv6-r384-xp75)
vuldb·2026-06-24·CVSS 9.6
CVE-2026-55447 [CRITICAL] langflow-ai langflow up to 1.9.1 symlink (GHSA-ccv6-r384-xp75)
A vulnerability, which was classified as critical, was found in langflow-ai langflow up to 1.9.1. Affected by this issue is some unknown functionality. Such manipulation leads to symlink following.
This vulnerability is listed as CVE-2026-55447. The attack may be performed from remote. There is no available exploit.
You should upgrade the affected component.
GHSA
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
ghsa·2026-06-19
CVE-2026-55447 [CRITICAL] CWE-200 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
### Summary
All components based on `BaseFileComponent` are vulnerable to the following vulnerability:
1. Docling (`DoclingInlineComponent`)
2. Docling Serve (`DoclingRemoteComponent`)
3. Read File (`FileComponent`)
4. NVIDIA Retriever Extraction (`NvidiaIngestComponent`)
5. Video File (`VideoFileComponent`)
6. Unstructured API (`UnstructuredComponent`)
For clarity, from now on I'll only refer to Read File component.
The Read File node processes user-controlled files.
Example scenario is a RAG chatbot - a system that allows users of an organization to ask questions about documents saved in the organizations.
By controlling a files that are digested into the RAG, an attacker can direct the node to read *any* fi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-23
Published