CVE-2026-55447: Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

All six components share BaseFileComponent in lfx/base/data/base_file.py. Its _unpack_bundle function extracts uploaded tar files. A tar can hold a symlink that points anywhere on the file system. process_files() then reads the target of that link, and the content goes into whatever the flow feeds, such as a vector store.

The researcher's scenario is a RAG chatbot over documents that users upload. The attacker uploads a tar whose symlink points to Langflow's secret_key file, then asks the chatbot about the document. The reply contains the JWT signing secret. With it the attacker forges a JWT for any user ID and bypasses authentication. They then create a flow with a Python Interpreter node and run arbitrary Python on the server. A tar can hold many symlinks, so several files can be read in one upload.

The flaw affects any flow that ingests user-controlled files with these nodes. The score is 9.6 and needs user interaction. Besides the secret key, any file the Langflow process can read is exposed, such as environment files and API keys for model providers.

pip package langflow before 1.9.2, in deployments that use any of the six BaseFileComponent nodes on files that untrusted users supply. Flows that only ingest files from trusted people are less exposed. Check the version:

pip show langflow

List your flows for Read File, Docling, Docling Serve, NVIDIA Retriever Extraction, Video File and Unstructured API nodes.

Upgrade to Langflow 1.9.2 or later.

pip install --upgrade langflow==1.9.2

Pull request 12945 makes _safe_extract_tar raise a ValueError for symlink, hardlink, FIFO and device-node entries, so the whole bundle is refused. Symlinks are also skipped during the directory walks as a backup. Ordinary tars with regular files and directories still extract. The sources list no workaround. If you cannot upgrade, stop accepting tar uploads in these nodes. Rotate the secret_key and any credentials stored on the host if untrusted users could upload files.

Inspect uploaded archives for symlink entries with tar -tvf archive.tar, where a -> in a line marks a link. In the vector store, look for chunks that contain a JWT secret, environment variables or system file contents. Review Langflow logs for sessions authenticated with tokens for users who did not log in, and for new flows containing a Python Interpreter node that nobody on the team created.

Summary

All components based on BaseFileComponent are vulnerable to the following vulnerability:

1. Docling (DoclingInlineComponent)
2. Docling Serve (DoclingRemoteComponent)
3. Read File (FileComponent)
4. NVIDIA Retriever Extraction (NvidiaIngestComponent)
5. Video File (VideoFileComponent)
6. Unstructured API (UnstructuredComponent)

For clarity, from now on I'll only refer to Read File component.

The Read File node processes user-controlled files. Example scenario is a RAG chatbot - a system that allows users of an organization to ask questions about documents saved in the organizations.

By controlling a files that are digested into the RAG, an attacker can direct the node to read *any* file on the file-system by absolute path.

Using this vulnerability an attacker can acheive RCE:

1. Upload a file that directs the node to read Langflow's secret_key file containing the JWT token secret.
2. This would allow the attacker then to simply task the Chatbot for the JWT secret.
3. Using this secret, the attacker then crafts a JWT token for any user-id, bypassing authentication.
4. Code execution is then trivial - simply create a new flow with "Python Interpreter" node, fill it with arbitrary Python code and execute it.

Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe

Details

The vulnerability is in: langflow/src/lfx/src/lfx/base/data/base_file.py Specifically in _unpack_bundle. This function extracts tar files, which can contain a symlink. This symlink can point to any file in the filesystem. Then, in self.process_files(), the file pointed by the symlink will be parsed and saved into the RAG. This can be done with unlimited number of symlinks in the same tar which can also be useful in some scenarios.

Suggestd fix - iterate over the files and make sure all are regular files or directories.

PoC

Reproduction:

1. Create a flow with Read File (or any other affected components), and connect its output to some storage such as Chroma DB.
2. Create a symlink pointing to any file. For the above exploit, point the symlink to langflow's JWT token file.
3. Compress this symlink with tar.
4. Upload it to the Read File component.
5. Check the database, or ask a Chatbot connected to this vector database for the contents of the file.

Concrete PoC: ------------

• Flow with RAG ingestion and a Chatbot around it: Vector Store RAG.json
• Exploit tar: archive.tar.txt (remove .txt, GitHub blocked .tar)
• Create a file /tmp/trip.docx with any contents in it
• Ingest the file in the flow above, and ask the Chatbot a question about this file.

A demo showing the attack: https://github.com/user-attachments/assets/af00f700-f13f-4eac-848e-8afd11fb9297 In the demo the attacker steals Langflow secret key used to sign JWTs. The second stage of the attack, not shown in the demo, is using this key to sign a JWT token and executing Python code on the server using the Python code interpreter node.

Impact

Any Langflow user using any of the above mentioned components to ingest user-controlled data is affected. Depending on exact scenario, the user can also be exposed to an RCE risk.

Patches

Fixed in 1.9.2 via PR #12945. BaseFileComponent._unpack_bundle now rejects symlink and hardlink members (and any non-regular entries) during TAR extraction, with additional defensive symlink filtering during directory recursion and after extraction. Upgrade to 1.9.2 or later.

Ori Lahav Security Researcher @ Rubrik Inc.