Description

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when handling requests to the /api/v1/run/{flow_id} endpoint. An attacker with low‑privileged authenticated access (such as a valid API key or user session) can supply crafted path values, including absolute paths or path traversal sequences, allowing arbitrary file writes to locations writable by the Langflow process. Successful exploitation may lead to unauthorized file creation or modification, potentially resulting in further compromise depending on the deployment environment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:50.717Z",
  "pubdate": "2026-09-04T15:17:50.717Z",
  "executiveSummary": "IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a critical vulnerability involving improper input validation within the SaveToFileComponent.\nThis flaw allows an authenticated attacker to perform arbitrary file writes on the host server.\nThe vulnerability originates from the application's failure to adequately sanitize attacker-controlled input when constructing local file system paths via the /api/v1/run/{flow_id} endpoint.\nSuccessful exploitation enables an attacker with low-privileged access, such as a valid API key or active session, to write, overwrite, or modify files in locations accessible to the Langflow process.\nThe impact is significant, as it could lead to remote code execution, configuration manipulation, or complete system compromise depending on the server's directory permissions and deployment environment.\nThis vulnerability highlights a failure in path validation, specifically regarding path traversal and absolute path injection, posing a severe risk to the integrity and availability of the underlying infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is located in the SaveToFileComponent of IBM Langflow OSS, which performs server-side file operations without enforcing strict path sanitization or validation protocols.\nWhen a request is sent to the /api/v1/run/{flow_id} endpoint, the component accepts user-defined inputs that define the destination path for file write operations.\nBecause the application does not implement a secure lookup mechanism or a sandboxed environment for these operations, the input is treated as a trusted path relative to the process's working directory or as an absolute system path.\nAn attacker can exploit this by crafting a payload containing path traversal sequences (e.g., ../../) or by providing an absolute path directly to the file system.\nThe exploitation flow begins with the attacker establishing a low-privileged authenticated session or obtaining a valid API key, which is a prerequisite for interacting with the /api/v1/run/ endpoint.\nOnce authenticated, the attacker invokes the SaveToFileComponent and injects a malicious payload into the path parameter.\nThe backend process resolves this path using the system's file API, allowing the process to write arbitrary data into restricted directories.\nFor instance, an attacker could attempt to overwrite existing configuration files, binary files, or even inject malicious scripts into startup directories if the Langflow process runs with sufficient permissions.\nThe vulnerability affects Langflow OSS versions 1.0.0 through 1.11.2 across all standard deployment configurations.\nPost-exploitation, the attacker gains the ability to manipulate the server environment. This persistence mechanism allows for further compromise, such as escalating privileges or exfiltrating data, depending on the files modified or created during the attack.\nThe lack of input validation effectively bypasses intended design constraints, turning a legitimate file-saving feature into an arbitrary file write primitive that is accessible over the network."
}