Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M

CVE-2026-55447Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Critical 9.6

In plain English

A critical-severity information exposure in langflow from langflow-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.7%top 48.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	langflow	1.9.2	GHSA-ccv6-r384-xp75
PyPI	langflow	1.9.2	PYSEC-2026-378

Affected products (as reported)

Vendor	Product	Versions
langflow-ai	langflow	< 1.9.2

Weakness: CWE-61, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-ccv6-r384-xp75 x_refsource_CONFIRM
https://github.com/langflow-ai/langflow/pull/12945 x_refsource_MISC