CVE-2026-55447: Langflow arbitrary file read via absolute path in RAG file components
Langflow versions before 1.9.2 contain a flaw that lets an attacker who controls files ingested into a RAG workflow make a component read any file on the host by absolute path. The GitHub CNA assigns a CVSS 3.1 base score of 9.6, and the record states the issue is fixed in 1.9.2. The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.
Overview
Langflow is a platform for building AI agents and workflows. According to the record, versions before 1.9.2 let an attacker who can control files ingested into a retrieval-augmented generation (RAG) pipeline direct a file-handling component to read any file on the host by absolute path. The record classifies the weakness as CWE-61 without a name.
Impact
The CVSS 3.1 vector in the record indicates a network attack vector, low complexity, no privileges required, user interaction required, changed scope, and high impact to confidentiality, integrity and availability. Based on this scoring, the realistic worst case includes disclosure of sensitive local files and possibly wider compromise of the host. This is an inference from the vector, not a statement from the vendor.
Affected products and versions
- Product: Langflow Langflow, versions less than 1.9.2.
- Components named in the description: Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent) and Unstructured API (UnstructuredComponent).
- The description says all components based on BaseFileComponent are affected, so the named list may not be exhaustive.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation in the wild appears in the sources consulted. The vendor advisory carries an Exploit tag in the reference list, but that tag alone does not confirm attacks in the wild.
Remediation and mitigation
- Upgrade Langflow to version 1.9.2 or later, as stated in the record and the vendor advisory.
- Until the upgrade is applied, limit which users and data sources can supply files to RAG ingestion and file-based components.
- Run the Langflow service with least-privilege filesystem access so it cannot read sensitive directories, credential stores or configuration files outside its needs.
- Inventory deployments that use any of the named components and treat all BaseFileComponent-based nodes as in scope.
Detection guidance
- Review application logs for file-ingestion requests that reference paths outside the expected upload or data directories.
- Monitor for unexpected reads of configuration, secret or key files by the Langflow process.
- Watch for unusual outbound data transfers from Langflow hosts that follow file-ingestion activity.
Limitations of the available information
The record does not provide a CWE name, an EPSS score, SSVC data or KEV details beyond listing the CVE as not present. The record does not describe the detailed technical conditions under which the flaw can be reached in a given deployment, and the affected-version list is given only as a range. Organizations should confirm their exact version and component usage against the vendor advisory.
Frequently asked questions
Which Langflow versions are affected by this CVE?
The record lists Langflow versions less than 1.9.2 as affected. The fix is stated to be in version 1.9.2.
Is this vulnerability known to be actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.