Langflow 存在任意文件写入漏洞（CVE-2026-33309）

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.endorlabs.com/vulnerability/cve-2026-33309
• https://www.cve.org/CVERecord?id=CVE-2026-33309
• https://advisories.gitlab.com/pypi/langflow/CVE-2026-33309/
• https://www.sentinelone.com/vulnerability-database/cve-2026-33309/
• https://github.com/advisories/GHSA-g2j9-7rj2-gm6c
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-g2j9-7rj2-gm6c
• https://www.cvedetails.com/cve/CVE-2026-33309/
• https://zhuanlan.zhihu.com/p/2018334166954033325
• https://avd.aliyun.com/product?prod=langflow&page=-4
• https://zhuanlan.zhihu.com/p/2018638608169443911

Related Vulnerabilities

• PoClangflow-api-exposure: Langflow - Unauthenticated API Exposure
• PoCCVE-2026-0768: Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code
• Langflow /api/v1/custom_component 代码执行漏洞（CVE-2024-37014）
• PoCCVE-2024-37014: Langflow <= 1.0.12 - Remote Code Execution
• IBM Langflow OSS 远程代码执行漏洞（CVE-2026-9198）
• PoCCVE-2026-55450: Langflow < 1.9.1 - Unauthenticated File Upload
• PoCCVE-2026-33497: Langflow < 1.7.0 - Path Traversal
• PoCCVE-2026-9198: IBM Langflow - Remote Code Execution
• Langflow build_public_tmp 代码执行漏洞（CVE-2026-33017）
• PoCCVE-2026-5027: Langflow <= 1.8.4 - Path Traversal to RCE via File Upload
• Langflow /api/v2/files 文件上传漏洞（CVE-2026-5027）
• Langflow /api/v1/validate/code 代码执行漏洞（CVE-2026-0770）
• PoCCVE-2026-33017: Langflow < 1.9.0 - Remote Code Execution