CVE-2026-33309: Langflow Arbitrary File Write via v2 API

# CVE-2026-33309: Langflow Arbitrary File Write via v2 API

https://gcdradar.vercel.app/incidents/cve-2026-33309-langflow-arbitrary-file-write-via-v2-api · AIR-2026-0504 · closed 2026-03-19

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-03-19
- AI role: Attack on AI
- Products: Langflow
- CVE ids: CVE-2026-33309
- CVSS: 9.9

## Summary

An arbitrary file write vulnerability exists in Langflow's file upload endpoint due to insufficient boundary containment checks in the storage layer. The flaw permits authenticated attackers to write files to arbitrary locations on the host.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-03-24: CVE-2026-33309: Langflow is a tool for building and deploying AI-powered agents and workflows. (https://nvd.nist.gov/vuln/detail/CVE-2026-33309)
- 2026-03-19: CVE-2026-33309: Langflow has an Arbitrary File Write (RCE) via v2 API (https://github.com/advisories/GHSA-g2j9-7rj2-gm6c)

## Sources

- 2026-03-19 GitHub Advisory Database: CVE-2026-33309: Langflow has an Arbitrary File Write (RCE) via v2 API https://github.com/advisories/GHSA-g2j9-7rj2-gm6c
- 2026-03-24 NVD: CVE-2026-33309: Langflow is a tool for building and deploying AI-powered agents and workflows. https://nvd.nist.gov/vuln/detail/CVE-2026-33309

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.