High · 7.5 CVE-2026-12942 EUVD-2026-51243GHSA-rmxx-p7v6-pmfp

Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints

Published Jul 30, 2026 · Updated Jul 30, 2026 · Assigned by ibm

Description

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

Affected products

Vendor	Product	Affected	Fixed
IBM	Langflow OSS	1.0.0 – ≤ 1.10.1	—

Advisories 1

WID-SEC-2026-2366 IBM Langflow Desktop: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 30, 2026

References

https://www.ibm.com/support/pages/node/7279993 vendor-advisory patch