Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-33497

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch.
Exploit prediction scoring system (EPSS) score
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-33497


Contact Us

Shodan ® - All rights reserved