Description

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T17:16:55.227Z",
  "pubdate": "2026-09-04T17:16:55.227Z",
  "executiveSummary": "IBM Langflow OSS versions 1.0.0 through 1.10.2 are susceptible to a Path Traversal vulnerability arising from the improper limitation of pathnames to restricted directories.\nThis flaw allows a remote, authenticated attacker to bypass intended directory restrictions and gain unauthorized access to sensitive information residing within the filesystem.\nThe vulnerability type, categorized as improper limitation of a pathname to a restricted directory, essentially permits directory traversal attacks.\nImpacts include potential disclosure of configuration files, source code, environment variables, or other sensitive data that should remain inaccessible to end-users.\nExploitation requires the attacker to be authenticated to the IBM Langflow platform, after which they may manipulate file path parameters or inputs to access files outside the intended application boundary.\nThis vulnerability poses a significant risk to the confidentiality of the environment, as it could expose critical system information used in subsequent attacks or facilitate further compromise of the underlying infrastructure.",
  "technicalDetails": "The vulnerability resides in the way IBM Langflow handles file-related requests or input paths, specifically failing to properly sanitize or validate inputs before using them in file system operations.\nThe root cause is an improper implementation of path validation mechanisms, allowing an attacker to utilize directory traversal sequences—typically represented as '..\\' or '../'—to escape the application's intended root directory.\nWhen the application accepts user-supplied input to reference or retrieve files, the lack of rigorous path canonicalization means that the system resolves the path based on the attacker's input, traversing up the directory tree.\nAn authenticated attacker can leverage this flaw by supplying a crafted malicious payload within an affected API endpoint or application feature that handles file system access.\nUpon receiving the request, the underlying backend service improperly concatenates the attacker-provided input directly to a base directory path. By injecting traversal sequences, the attacker successfully references arbitrary files located elsewhere on the host operating system.\nThe attack flow follows a sequential process: first, the attacker authenticates into the IBM Langflow environment. Second, the attacker identifies a vulnerable interface that accepts file-related inputs. Third, the attacker submits a request containing directory traversal sequences designed to target specific sensitive files.\nBecause the application performs the file system operation with the privileges of the service user running the Langflow process, any file readable by that user account can be accessed and exfiltrated, regardless of whether the file was intended to be accessible through the application interface.\nThe impact is significant, as this can lead to the exposure of authentication tokens, API keys, database credentials, or system configuration files, providing an attacker with the necessary components to escalate their privileges, move laterally, or fully compromise the hosting server.\nThis vulnerability affects IBM Langflow OSS versions 1.0.0 through 1.10.2, and there are no inherent constraints on the file type being accessed, provided the service user has the necessary read permissions."
}