CVE-2026-33497highexploração observadaCWE-22

CVE-2026-33497: falha de alta gravidade em langflow-ai langflow

Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading

Publicada em

Seguir esta CVE+ Monitorar langflow+ Monitorar langflow

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

63Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 8.7epss 20%
da publicação à arma
Publicada no NVD24 de mar.
VulnCheck+140d
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
langflow-ai · langflow
CVEs relacionadas — langflow-ai langflow

No mesmo produto, das mais perigosas para as menos.

CVE-2025-3248CRITICALLangflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codeEPSS 100.0%KEVCVE-2026-33017CRITICALLangflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointEPSS 96.4%KEVCVE-2026-55255HIGHLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's FlowEPSS 0.9%KEVCVE-2026-5027HIGHLangflow - Path Traversal Arbitrary File Write via upload_user_fileEPSS 40.0%CVE-2026-27966CRITICALLangflow has Remote Code Execution in CSV AgentEPSS 35.2%CVE-2026-21445HIGHLangflow Missing Authentication on Critical API EndpointsEPSS 33.3%