Description

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-04T16:17:24.793Z",
  "pubdate": "2026-09-04T16:17:24.793Z",
  "executiveSummary": "IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a critical Arbitrary File Read vulnerability. The flaw originates from an improper validation of input parameters within the build request pipeline, allowing authenticated attackers to bypass security containment boundaries.\nBy manipulating the 'files' parameter, an attacker can access sensitive system files, including cryptographic material such as the secret_key and JWT signing keys, environment variables, and the application database. This data is exfiltrated by embedding file content as text attachments in language model prompts, which are then transmitted to configured LLM endpoints.\nThe vulnerability effectively bypasses the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true security control, which failed to protect the specific Chat Input to Message attachment pipeline. The risk to confidentiality is extreme, as it provides a pathway for full system compromise, lateral movement through credential theft, and unauthorized access to multi-tenant data. Exploitation requires authenticated access to the application, but no further special privileges are necessary to conduct the file retrieval operations.",
  "technicalDetails": "The vulnerability is rooted in an input validation failure within the Langflow build request processing logic. Specifically, the 'files' parameter in an authenticated build request fails to sanitize or restrict paths, permitting the use of absolute file paths or directory traversal sequences (e.g., ../).\nAlthough the system is intended to be protected by the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, this enforcement mechanism is selectively applied. Analysis reveals that while other file-reading components respect this restriction, the Chat Input to Message attachment pipeline lacks the necessary input validation checks to prevent unauthorized file access.\nThe exploitation flow proceeds as follows: First, an attacker authenticates to the Langflow instance. Second, the attacker crafts a malicious build request, injecting the target file path (e.g., '/etc/passwd', '/proc/self/environ', or application configuration files containing secret_key and JWT signing keys) into the 'files' parameter. Third, the backend application processes the request, retrieves the contents of the specified file, and treats the content as a text attachment.\nFinally, the application automatically embeds the retrieved file contents into the prompt sent to the configured language model endpoint. By observing the model's response or inspecting the request/response logs, the attacker recovers the sensitive content that was processed during the prompt construction phase.\nThis vulnerability is present in IBM Langflow OSS versions 1.0.0 through 1.11.2. The lack of validation on the 'files' parameter allows an attacker to interact with the underlying host filesystem with the privileges of the service account running the Langflow process. Post-exploitation impact includes the total loss of confidentiality regarding application secrets, potentially leading to forged authentication tokens, database compromise, and exposure of other tenants' sensitive information stored within the local filesystem."
}