CVE-2026-33497 — Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_…
Published: 2026-03-24 · CVSS: 8.7 · CVSS 4.0
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7