Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Langflow
More for Langflow RSS feed for Langflow
- Severity
- Critical, CVSS 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Record
- CVE-2026-55447
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 25, 2026
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.
Description quoted from the NVD record.
Who is affected
Langflow is a tool for building and running apps and workflows that use AI language models. This flaw affects Langflow versions before 1.9.2. It is in the building blocks that read files into a workflow, including Read File, Video File, Docling, Docling Serve, NVIDIA Retriever Extraction and Unstructured API. If an attacker can control files that a workflow takes in as reference material for the AI, they can make one of these building blocks read any file stored on the computer running Langflow. This flaw is rated Critical.
What to do
- If someone in your organization installed or runs Langflow, ask them to check which version is in use. Any version before
1.9.2is affected. - That person should update Langflow to version
1.9.2or later, which fixes this flaw. - If an IT provider or vendor runs Langflow for your organization, send them this advisory and ask when the update will be done.
- If you are not sure whether Langflow is used at all, ask the person who looks after your computers or your IT provider to check, since any copy before
1.9.2needs the update.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.