{"id":"CVE-2026-48520","published":"2026-06-23T16:31:27Z","modified":"2026-06-24T14:19:11Z","title":"Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read","vendor":"langflow-ai","product":"langflow","tier":"tail","description":{"text":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the \"Shareable Playground\" (or \"Public Flows\" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used. By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration This vulnerability is fixed in 1.10.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00437,"percentile":0.37883,"provenance":"source"},"cwes":[{"id":"CWE-73","name":"External Control of File Name or Path"}],"references":[{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-rcjh-r59h-gq37","tags":["x_refsource_CONFIRM"]}],"priority":{"score":11.8,"factors":[{"name":"EPSS percentile","points":7.58},{"name":"CVSS severity","points":4.27}]},"vendorSlug":"langflow-ai","affectedVersions":[{"vendor":"langflow-ai","product":"langflow","versions":["< 1.10.0"]}],"affected":[{"ecosystem":"PyPI","package":"langflow","vulnerableRanges":["<1.10.0"],"patched":["1.10.0"],"from":["GHSA-rcjh-r59h-gq37","PYSEC-2026-244"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-38520","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2026-48519","published":"2026-06-23","fixed":"1.9.2","kev":false},{"cve":"CVE-2026-55255","published":"2026-06-23","fixed":"1.9.2","kev":true},{"cve":"CVE-2026-55447","published":"2026-06-23","fixed":"1.9.2","kev":false,"link":{"from":"CVE-2026-55447","to":"CVE-2026-48520","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:langflow","fromFixed":"1.9.2","toFixed":"1.10.0","daysApart":0}]}},{"cve":"CVE-2026-48520","published":"2026-06-23","fixed":"1.10.0","kev":false},{"cve":"CVE-2026-7873","published":"2026-06-30","fixed":"1.10.1.rc0","kev":false,"link":{"from":"CVE-2026-48520","to":"CVE-2026-7873","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:langflow","fromFixed":"1.10.0","toFixed":"1.10.1.rc0","daysApart":7}]}},{"cve":"CVE-2026-10561","published":"2026-06-22","fixed":"1.10.1","kev":false},{"cve":"CVE-2026-105698","published":"2026-10-05","fixed":"1.10.1","kev":false}],"package":"PyPI:langflow"}}