Summary
langflow: /profilepictures/{foldername}/{file_name} endpoint file reading
Vulnerability
Path Traversal in GET /api/v1/files/profile_pictures/{folder_name}/{file_name}
The download_profile_picture function in src/backend/base/langflow/api/v1/files.py constructed file paths by directly concatenating the user-supplied folder_name and file_name path parameters without sanitization or boundary validation. The resulting path was passed to the filesystem without verifying it remained within the intended directory.
An unauthenticated attacker could supply traversal sequences (e.g. ../secret_key) to navigate outside the profile pictures directory and read arbitrary files on the server filesystem.
This exposed the server to:
- Sensitive file disclosure, any file readable by the application process could be retrieved
- Secret key exfiltration, the application's
secret_keyfile, used as JWT signing material, could be read directly via../secret_key - Authentication bypass, with the
secret_keyin hand, an attacker can forge valid JWT tokens and authenticate as any user, including administrators
Proof of Concept
curl --path-as-is 'http://<host>:7860/api/v1/files/profile_pictures/../secret_key'
A successful response returns the raw secret key value used to sign all JWT authentication tokens in the instance.
Workarounds
If you cannot upgrade immediately, restrict network access to the /api/v1/files/profile_pictures/ endpoint at the reverse-proxy or firewall level. Rotating the secret_key is strongly recommended if exposure cannot be ruled out.
Acknowledgements
We thank the security researcher who responsibly disclosed this vulnerability.
Impact
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The fix was applied in src/backend/base/langflow/api/v1/files.py (PR #12263).
Two layers of defense were introduced:
1. Typed path validation, the folder_name and file_name parameters were changed from plain str to ValidatedFolderName and ValidatedFileName annotated types that reject traversal characters at the FastAPI input layer.
2. Path containment check, Path.name is used to strip any directory component from the inputs before path construction, and Path.is_relative_to() verifies the resolved path remains within the allowed base directory. This replaces the previous startswith() check, which was susceptible to prefix-ambiguity bugs.
@router.get("/profile_pictures/{folder_name}/{file_name}")
async def download_profile_picture(
- folder_name: str,
- file_name: str,
+ folder_name: ValidatedFolderName,
+ file_name: ValidatedFileName,
settings_service: Annotated[SettingsService, Depends(get_settings_service)],
):
- file_path = (config_path / "profile_pictures" / folder_name / file_name).resolve()
+ safe_folder = Path(folder_name).name
+ safe_file = Path(file_name).name
+ file_path = (config_path / "profile_pictures" / safe_folder / safe_file).resolve()
allowed_base = (config_path / "profile_pictures").resolve()
- if not str(file_path).startswith(str(allowed_base)):
- raise HTTPException(status_code=404, detail="Profile picture not found")
+ if not file_path.is_relative_to(allowed_base):
+ raise HTTPException(status_code=404, detail="Profile picture not found")
Frequently Asked Questions
- What is CVE-2026-33497? CVE-2026-33497 is a high-severity path traversal vulnerability in langflow (pip), affecting versions < 1.7.1. It is fixed in 1.7.1. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which versions of langflow are affected by CVE-2026-33497? langflow (pip) versions < 1.7.1 is affected.
- Is there a fix for CVE-2026-33497? Yes. CVE-2026-33497 is fixed in 1.7.1. Upgrade to this version or later.
- Is CVE-2026-33497 exploitable, and should I be worried? Whether CVE-2026-33497 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-33497 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-33497? Upgrade
langflowto 1.7.1 or later.