GHSA-x223-p2gf-v735 is a critical-severity (CVSS 9.3) Information Exposure vulnerability in langflow. EPSS puts its 30-day exploitation probability at 11.8% (96th percentile). O3 Security confirms whether GHSA-x223-p2gf-v735 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for GHSA-x223-p2gf-v735.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-x223-p2gf-v735 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 0 CVEs with a current EPSS score, this one falls in the 10–50% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
langflowReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow.
This can lead to space exhaustion on the server.
In adition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives.
Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe
Details
Code is in langflow/api/v1/[endpoints.py](http://endpoints.py/):
@router.post(
"/upload/{flow_id}",
status_code=HTTPStatus.CREATED,
deprecated=True,
)
async def create_upload_file(
file: UploadFile,
flow_id: UUID,
) -> UploadFileResponse:
...
As can be seen above, there is no authentication. There is not validation over flow_id as well, unlike other endpoints:
flow_id_str = str(flow_id)
file_path = await asyncio.to_thread(save_uploaded_file, file, folder_name=flow_id_str)
Function save_uploaded_file saves the file to local file-system.
Suggested fix:
- Add authentication to route.
- Only return relative path or filename.
PoC
PoC:
curl 'http://localhost:7860/api/v1/upload/<any_uuid>' -F "file=@<any_file>"
Example:
# curl 'http://localhost:7860/api/v1/upload/11111111-1111-1111-1111-111111111111' -F "file=@/tmp/dummy.txt"
{"flowId":"11111111-1111-1111-1111-111111111111","file_path":"/Users/ori/Library/Caches/langflow/11111111-1111-1111-1111-111111111111/9d63c3b5b7623d1fa3dc7fd1547313b9546c6d0fbbb6773a420613b7a17995c8.txt"}
Impact
- Space exhaustion on server that can lead to Denial-of-Service.
- Information leak - leakage of absolute path of langflow's cache directory in server.
Patches
Fixed in 1.9.1 via PR #12831. The deprecated POST /api/v1/upload/{flow_id} endpoint now uses the get_flow dependency, requiring an authenticated user and flow ownership (returns 404 for missing or cross-user flows), and enforces the max_file_size_upload limit (HTTP 413) — closing the unauthenticated upload and disk-exhaustion vectors. Upgrade to 1.9.1 or later.
Note: the response still returns the file's absolute path (file_path); after this fix it is only disclosed to the authenticated owner of the flow.
Ori Lahav Security Researcher @ Rubrik Inc.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | langflow | all versions | 1.9.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for langflow. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update langflow to 1.9.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-x223-p2gf-v735 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-x223-p2gf-v735 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-x223-p2gf-v735. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-x223-p2gf-v735 in your dependencies?
O3 detects GHSA-x223-p2gf-v735 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.