CVE-2026-55447

Katalog CVE

CVSS 9.6 · Critical EPSS 0,66%

Kerentanan UNIX Symbolic Link (Symlink) Following pada langflow. Skor CVSS 3.1 9.6 (Critical) menurut github.com.

Deskripsi (NVD)

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

24 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-61: UNIX Symbolic Link (Symlink) Following
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/langflow-ai/langflow/security/advisories/GHSA-ccv6-r384-xp75 exploit · patch · advisory vendor
• https://github.com/langflow-ai/langflow/pull/12945 issue tracking · patch