CVE-2026-33497 - Vulnerability Analysis

Overview

Langflow < 1.7.1 contains a path traversal caused by insufficient filtering of folder_name and file_name parameters in download_profile_picture endpoint, letting attackers read secret_key across directories, exploit requires crafted request.

Severity & Score

Impact

Attackers can read sensitive secret_key files across directories, potentially compromising system security.

Mitigation

Update to version 1.7.1 or later.

References

• https://github.com/langflow-ai/langflow/security/advisories/GHSA-ph9w-r52h-28p7

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 24, 2026

🟠 CVE-2026-33497 - High (7.5) Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters a... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33497/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner