Skip to content
OpenAdvisories
High WID-SEC-2026-1713 3 CVEs

Langflow: Mehrere Schwachstellen

Published May 27, 2026 · Updated Jun 23, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.

Product

Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.

Vulnerabilities 3

  • Critical 9.8
    CVE-2026-7524

    Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction.

    IBM Langflow OSS
  • Critical 9.6
    CVE-2026-48519 Public exploit

    Langflow: Unauthenticated RCE in Shareable Playgrounds

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workfl…

    langflow-ai langflow langflow PyPI
  • High 7.1
    CVE-2026-7528

    Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS

    IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption.

    IBM Langflow OSS

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-38514

  2. #1

    Initiale Fassung

References