Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
Summary
The "Shareable Playground" (or "Public Flows" in code) contains a potential arbitrary file-read vulnerability, depending on the exact flow configuration used.
By making a flow public, public execution of the flow is allowed. The execution request can contain a list of files that gets read by Langflow and fed into the LLM. The files path can be any path supported by the storage - it can be either a local file or S3 path if supported by the local configuration
Details
Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link.
Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID.
This request contains a files field that can contain a list of files. The files get read in LCModelComponent._get_chat_result in a call to to_lc_message. A detailed stacktrace:
...
File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 466, in build_vertices
vertex_build_response: VertexBuildResponse = await _build_vertex(vertex_id, graph, event_manager)
File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 324, in _build_vertex
vertex_build_result = await graph.build_vertex(
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1563, in build_vertex
await vertex.build(
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/vertex/base.py", line 770, in build
await step(user_id=user_id, event_manager=event_manager, **kwargs)
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/events/observability/lifecycle_events.py", line 95, in wrapper
result = await observed_method(self, *args, **kwargs)
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/vertex/base.py", line 411, in _build
await self._build_results(
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/vertex/base.py", line 640, in _build_results
result = await initialize.loading.get_instance_results(
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/interface/initialize/loading.py", line 76, in get_instance_results
return await build_component(params=custom_params, custom_component=custom_component)
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/interface/initialize/loading.py", line 299, in build_component
build_results, artifacts = await custom_component.build_results()
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/custom/custom_component/component.py", line 1136, in build_results
return await self._build_with_tracing()
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/custom/custom_component/component.py", line 1118, in _build_with_tracing
results, artifacts = await self._build_results()
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/custom/custom_component/component.py", line 1163, in _build_results
result = await self._get_output_result(output)
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/custom/custom_component/component.py", line 1238, in _get_output_result
result = await method() if inspect.iscoroutinefunction(method) else await asyncio.to_thread(method)
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/base/models/model.py", line 88, in text_response
result = await self.get_chat_result(
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/base/models/model.py", line 180, in get_chat_result
return await self._get_chat_result(
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/base/models/model.py", line 232, in _get_chat_result
messages.append(input_value.to_lc_message(self.name))
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/schema/message.py", line 184, in to_lc_message
file_contents = self.get_file_content_dicts(model_name)
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/schema/message.py", line 256, in get_file_content_dicts
content_dicts.append(create_image_content_dict(file, None, model_name))
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/utils/image.py", line 96, in create_image_content_dict
...This triggers Langflow to feed the file into the LLM as an Image. Reading the files back depends on the specific LLM configuration.
PoC
Reproduction:
- Create a new flow and add a Chat Input node to it
- Share the flow ("Shareable Playground")
- Access the public link with the browser developers tools open and execute the flow.
- Find the
/api/v1/build_public_tmproute and copy as cURL - Edit the
filesJSON field to point to any file.
Impact
Potential file read (local or S3) if shareable playground feature is used.
Ori Lahav Security Researcher @ Rubrik Inc.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | langflow | < 1.10.0 | 1.10.0 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N- Debilidad (CWE)
CWE-73- Plataforma
- Python (PyPI)
- Paquete
langflow- Publicada
- 16.06.2026
- Actualizado
- 11.10.2026 14:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-244 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-rcjh-r59h-gq37 - CC BY 4.0
Historial de vulnerabilidades: langflow
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 42
- Primera → última
- 06.2024 10.2026
- Sin corrección
- 7
- Explotada en ataques
- 5
Distribución por gravedad
- Crítica 15
- Alta 17
- Media 7
- Baja 3
Divulgaciones por año
- 2024: 4
- 2025: 5
- 2026: 33
-
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.