PkgSeer

Vulnerability PYSEC-2026-2572

High Risk

3 months ago

Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API

0.0.13 - 0.9.0

Summary

Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API

Details

A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

0.0.13 - 0.10.1rc3 PYSEC-2026-4238

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

0.1.2 - 0.10.3rc0 PYSEC-2026-4239

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

0.1.2 - 0.10.3rc0 GHSA-w794-rj3p-xv45

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

0.0.13 - 0.10.1rc3 GHSA-gh98-4phw-6fmw

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

0.0.13 - 0.10.3rc0 GHSA-j8f7-x8jm-wmm4

View all vulnerabilities for these packages

Impacted packages

langflow-base

Timeline

Published

3 months ago

Fixed (0.9.1)

5 months ago

Last Modified

3 months ago