/Vulnerability Library

Langflow < 1.9.1 - Unauthenticated File Upload

CVE-2026-55450
Verified

Description

Langflow < 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access.

Severity

Critical

CVSS Score

9.3

Exploit Probability

1%

Published Date

July 13, 2026

Template Author

xtr0nix

CVE-2026-55450.yaml
9.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H
CVE ID:
cve-2026-55450
CWE ID:
cwe-306, cwe-400, cwe-200

References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735

Remediation Steps

Update to version 1.9.1 or later.