CVE-2026-5026 — Langflow - Stored XSS via Malicious SVG Upload
The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content. Since SVG files can contain e…
Published: 2026-03-27 · CVSS: 7.0 · CVSS 4.0
The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content. Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leading to stored cross-site scripting (XSS). This allows stealing authentication tokens stored in cookies, including JWT access and refresh tokens.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7