CVE

CVE-2026-33497

8.7

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

langflow

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

Langflow < 1.7.0 - Path Traversal

Langflow References: https://github.com/langflow-ai/langflow/security/advisories/GHSA-ph9w-r52h-28p7 https://nvd.nist.gov/vuln/detail/CVE-2026-33497 Remediation: Update to version 1.7.1 or later.

url

Scanner page →Run scanner

CVE history: langflow

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →