{
 "id": "AIR-2026-0504",
 "slug": "cve-2026-33309-langflow-arbitrary-file-write-via-v2-api",
 "title": "CVE-2026-33309: Langflow Arbitrary File Write via v2 API",
 "summary": "An arbitrary file write vulnerability exists in Langflow's file upload endpoint due to insufficient boundary containment checks in the storage layer. The flaw permits authenticated attackers to write files to arbitrary locations on the host.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Langflow"
 ],
 "incident_date": "2026-03-19",
 "incident_date_precision": "day",
 "first_reported": "2026-03-19",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-g2j9-7rj2-gm6c",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-33309: Langflow has an Arbitrary File Write (RCE) via v2 API",
   "published_at": "2026-03-19"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33309",
   "publisher": "NVD",
   "title": "CVE-2026-33309: Langflow is a tool for building and deploying AI-powered agents and workflows.",
   "published_at": "2026-03-24"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-33309",
  "arbitrary-file-write",
  "langflow"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}