CVE-2026-55447

CriticalCVSS 9.6/10Last modified Jun 24, 2026

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-61CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jun 23, 2026
Last modified
Jun 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-554486.3mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from locCVE-2026-55456.5libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticCVE-2026-554509.3Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount oCVE-2026-554518.3gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits neCVE-2026-554527.3Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsCoCVE-2026-554533.3OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quotCVE-2026-554549.9Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — whCVE-2026-554559.1Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClieCVE-2026-554577.4The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, ConfigurationCVE-2026-554597.4The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version CVE-2026-55466.3A flaw has been found in Campcodes Complete Online Learning Management System 1.0. This impacts the function add_lesson of the file /applicaCVE-2026-554607.1Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but withou