The vulnerability CVE-2026-6596 affects langflow-ai langflow up to version 1.1.0. It is caused by insufficient validation in the create_upload_file function located in src/backend/base/Langflow/api/v1/endpoints.py, which leads to unrestricted file upload capability. This flaw can be exploited remotely without authentication or user interaction. The vendor was notified but has not issued any fix or advisory. No official remediation or patch links are available, and the vulnerability is publicly disclosed with exploit code released.

Successful exploitation allows an attacker to upload arbitrary files to the affected system remotely. This can lead to unauthorized file placement, potentially enabling further attacks such as code execution or system compromise depending on the environment and file handling. The CVSS score of 6.9 reflects a medium severity impact with network attack vector and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as restricting upload functionality, validating and sanitizing uploaded files manually, or isolating the affected service until an official patch is available.