{"data":{"id":"2e018c7f-91fc-4fad-85d0-a14ef8759a16","title":"CVE-2026-6596: A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function…","summary":"CVE-2026-6596 is a flaw in langflow-ai langflow up to 1.1.0, in the create_upload_file function of src/backend/base/Langflow/api/v1/endpoints.py in the API Endpoint component. It allows unrestricted upload and can be exploited remotely. The exploit has been publicly released, and the vendor did not respond to early disclosure contact. CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type) are associated with it.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6596","publishedAt":"2026-04-20T03:16:16.967Z","cveId":"CVE-2026-6596","cweIds":["CWE-284","CWE-434"],"cvssScore":"7.3","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow-base@< 0.9.1 (fixed: 0.9.1)"],"affectedPackageNames":["langflow-base"],"affectedPackageRefs":["pypi:langflow-base"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow unrestricted file upload in create_upload_file API endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00472,"epssCheckedAt":"2026-10-14T06:09:05.631Z","kevDateAdded":null,"advisoryAliases":["GHSA-vvfc-fp59-m92g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:27.074Z","patchAvailable":true,"disclosureDate":"2026-04-20T03:16:16.967Z","capecIds":["CAPEC-1"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}