# Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Langflow's BaseFileComponent tar extraction follows symlinks, letting an uploaded archive read arbitrary files like the JWT secret_key, enabling auth bypass and RCE.

- Payout: Research
- Severity: critical
- Program: Langflow
- Found by: vbCrLf, AntonioABLima, andifilhohub
- Disclosed: 2026-06-19
- CVE: CVE-2026-55447
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-ccv6-r384-xp75
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-ccv6-r384-xp75
- Tags: area:ai domain:ai domain:web impact:ato impact:data-leak impact:rce kind:research platform:ghsa sev:critical tech:python technique:chained vuln:auth-bypass vuln:info-disclosure vuln:path-traversal vuln:rce

**Target:** BaseFileComponent file ingestion nodes (Read File, Docling, NVIDIA Ingest, Video File, Unstructured)
**Root cause:** _unpack_bundle extracts tar archives without validating member types, so symlink entries pointing to arbitrary filesystem paths are followed; process_files() then parses and stores the linked file's contents into the RAG.
**Steps:**
1. Create a flow with Read File (or another BaseFileComponent node) connected to a vector store such as Chroma DB.
2. Create a symlink pointing to a target file, e.g. Langflow's JWT secret_key file.
3. Compress the symlink into a tar archive.
4. Upload the tar to the Read File component.
5. Query the database or the connected chatbot to retrieve the contents of the linked file.
**How found:** Code review of _unpack_bundle in base_file.py: noticed tar extraction does not restrict member types, so symlinks survive extraction and are later followed by process_files().
**Exploitation:** Attacker uploads a tar containing a symlink to Langflow's secret_key; the node ingests the secret into the vector DB, which the attacker then queries via the chatbot. With the JWT signing secret they forge a token for any user-id, bypass auth, create a flow with a Python Interpreter node and execute arbitrary code.
**Escalation:** File read of JWT secret -> forged JWT for arbitrary user -> authenticated access -> Python Interpreter node for RCE.
**Insight:** When a component ingests user-supplied archives, check whether extraction preserves symlink/hardlink members; a symlink to a secrets file turns a RAG ingestion path into arbitrary file read, and any JWT signing key read becomes full auth bypass.