IBMCVE-2026-7869
IBM Langflow OSS: path traversal
Medium5.4CVE-2026-7869 · Published Aug 5, 2026 · updated Aug 6, 2026
IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Langflow OSS Product | >= 1.0.0, <= 1.10.3 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-22
More IBM advisories
All IBM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 5 | IBM Langflow OSS: weak cryptography | High7.4 | No fix yet |
| Aug 5 | IBM Langflow OSS: code injection | High8.1 | No fix yet |
| Aug 5 | IBM Langflow OSS: code execution | High8.8 | No fix yet |
| Aug 5 | IBM Langflow OSS: information disclosure | High7.1 | No fix yet |
| Aug 5 | IBM Langflow OSS: code injection | High8.8 | No fix yet |
| Aug 5 | IBM Langflow OSS: broken cryptography | High7.4 | No fix yet |