Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-17621 EUVD-2026-71464GHSA-vphj-p6fw-rf4h

Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components

Published Sep 4, 2026 · Updated Sep 10, 2026 · Assigned by ibm

Vendor: IBM Product: Langflow OSS

Description

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

Affected products

VendorProductAffectedFixed
IBM Langflow OSS 1.0.0 – ≤ 1.10.2 —

Advisories 1

References