CVE-2026-48520: Langflow Arbitrary File-Read in Public Flows

Technical summary

CVE-2026-48520 is an arbitrary file-read vulnerability (CWE-73) in Langflow versions prior to 1.10.0 affecting the Shareable Playground (Public Flows) feature. The vulnerability arises because public flow execution does not adequately restrict the file paths that can be included in execution requests. An attacker can supply file paths pointing to arbitrary locations—both local filesystem paths and remote storage paths (e.g., S3 URIs)—and Langflow will read and process these files. The read data is then passed to the LLM as part of normal flow execution. Attack success depends on the specific flow configuration, the permissions of the Langflow process, and which storage backends are configured.

Business impact

Exposure of sensitive data is the primary risk. Depending on what files an attacker can read, this could include configuration files, API keys, database credentials, customer data, or proprietary documents stored on the same system or accessible cloud storage. For organizations using public flows in production, this could lead to unauthorized access to backend systems, regulatory non-compliance (GDPR, HIPAA, SOC 2), and erosion of customer trust. The vulnerability only manifests if flows are intentionally made public, which may be common for demonstration, sandbox, or partner-facing use cases.

Affected systems

Langflow versions prior to 1.10.0 are affected. The vulnerability is only exploitable when a flow is explicitly set to public (Shareable Playground). Organizations running Langflow internally with no public flows are at lower risk. The risk scales with the number and sensitivity of publicly accessible flows and the file permissions granted to the Langflow process.

Exploitability

Exploitation requires network access to a public flow (AV:N), but the CVSS vector indicates high complexity (AC:H), likely due to configuration dependencies—not all flows or deployments are equally vulnerable. A user interaction component (UI:R) is noted, suggesting the attack path may involve social engineering or depends on specific flow behavior. No known public exploits are in KEV status. Proof-of-concept code would require knowledge of the target flow's input parameters and storage configuration, making opportunistic, large-scale attacks less practical than targeted attacks against known public flows.

Remediation

Upgrade to Langflow 1.10.0 or later. The patch implements proper input validation and path restrictions for file inclusion in public flow executions. After upgrading, audit any flows currently marked as public to verify they do not inadvertently expose sensitive data. For deployments that cannot immediately upgrade, restrict public flow execution via network controls, use IAM policies to limit the Langflow process's file system and cloud storage permissions, and minimize the sensitivity of data accessible to flows.

Patch guidance

Apply Langflow 1.10.0 or later. Verify the upgrade in your development and staging environments first, particularly if your flows depend on file-inclusion logic. Check the Langflow release notes and security advisory for any configuration changes or deprecations introduced in the patch. After upgrade, restart Langflow services and validate that existing flows continue to execute as expected.

Detection guidance

Monitor Langflow execution logs for public flow requests that include unusual file paths, especially those with path traversal sequences (../) or absolute paths pointing outside expected directories. Log and alert on S3 or cloud storage access patterns that deviate from normal flow operation. Inspect the flow configuration for any public flows and document which ones include file-reading steps. In a security audit, trace the file paths that have been accessed by public flows over the past months to identify any suspicious patterns or data exfiltration.

Why prioritize this

Although the CVSS score is moderate (6.1), the vulnerability enables unauthorized access to potentially sensitive files and requires only network access and a public flow to trigger. Organizations with public-facing Langflow deployments or flows that integrate file-reading logic should prioritize patching. The impact is elevated for firms handling regulated data or using Langflow in multi-tenant or customer-facing scenarios. The fix is straightforward (a version upgrade), making this a high-value remediation target.

Risk score, explained

The CVSS:3.1 score of 6.1 (MEDIUM) reflects: (1) Network-accessible attack vector (AV:N), increasing ease of reach; (2) High complexity (AC:H) and user interaction (UI:R) that limit direct automation of attacks and require specific configuration or social engineering; (3) Confidentiality impact (C:H)—files can be fully read—but no integrity or availability impact (I:N, A:N). The scope change (S:C) indicates that beyond the Langflow application itself, other systems may be affected if readable files contain cross-system credentials. The score is appropriate for a data-leakage risk that is real but requires configuration-specific conditions to exploit.

Frequently asked questions