{"cvss":0.0,"datePublished":"2026-08-11T00:00:00Z","dateUpdated":"2026-08-11T00:00:00Z","description":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch.","dueDate":"","id":"CVE-2026-33497","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Langflow","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"Langflow Langflow Improper Limitation of a Pathname to a Restricted Directory","vendor":"Langflow"}