Langflow Unauthorized Arbitrary File Upload Vulnerability Summary Vulnerability Overview Title: Unauthorized Arbitrary File Upload via Deprecated “Zombie” API Endpoint Description: A file upload vulnerability exists in Langflow. A deprecated API endpoint named remains active and lacks both authentication and ownership validation. Cause: The vulnerability arises from a deprecated endpoint that was not properly secured or removed during the migration to the new file management API. Affected Code Location: Vulnerable Code Snippet: Note: The new endpoint correctly uses to enforce authentication, whereas this vulnerable endpoint completely skips such checks. Impact Scope Affected Product: Langflow Affected Versions: <= 1.1.0 Severity: High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Potential Impact: Denial of Service (DoS): Attackers can repeatedly upload large files to exhaust server disk space, or upload numerous small files to deplete Inodes. Malware Hosting: Use the server as a hosting point for malicious files. Remediation Fixed Version: 1.1.0 Recommendation: Remove or fully deprecate the endpoint, ensuring all file upload operations undergo authentication and ownership checks. Proof-of-Concept Code (PoC)