Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um Informationen offenzulegen oder zu manipulieren.
Product
Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.
Vulnerabilities 4
-
Medium 6.5
Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
-
Medium 6.5
Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
-
Medium 5.4
Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.
-
Medium 4.9
Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-71491, EUVD-2026-71466, EUVD-2026-71464, EUVD-2026-71463
-
#1
Initiale Fassung
References
-
IBM Security Bulletin 7286293 vom 2026-09-03
https://www.ibm.com/support/pages/node/7286293
-
IBM Security Bulletin 7286294 vom 2026-09-03
https://www.ibm.com/support/pages/node/7286294