Langflow Vulnerable to External Control of File Name or Path

Vulnerability

Overview Langflow versions prior to 1.7.0 contain an arbitrary file write vulnerability in the flow creation endpoint. The endpoint accepts a fs_path field in the request body without any path restriction, normalization, or allowed directory enforcement. As a result, an attacker can specify an absolute path (e.g., /etc/poc.txt) and the server will serialize the Flow object into JSON and create or overwrite a file at that exact location [1][2].

Attack

Vector The vulnerability is exploitable by any authenticated user with access to the API endpoint. The endpoint requires authentication (API key or JWT) but after authentication, there are no further controls on the file path. An attacker can craft a request with a malicious fs_path pointing to a sensitive system file [2].

Impact

Successful exploitation allows an attacker to write arbitrary JSON content to any writable location on the filesystem. Depending on the file chosen, this could lead to privilege escalation, code execution (e.g., overwriting a cron job or an application configuration), or denial of service [1]. The impact is limited by the fact that the written content is a JSON representation of a Flow object, but the attacker controls the flow structure.

Mitigation

The issue is fixed in Langflow version 1.7.0. Users should upgrade immediately. No workarounds are mentioned [1][2]. The project is available on GitHub [3].