Medium · 6.5 CVE-2026-3345 EUVD-2026-26441GHSA-c8wg-94jj-9q2x

Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint

Published Apr 30, 2026 · Updated May 27, 2026 · Assigned by ibm

Description

IBM Langflow Desktop <=1.8.4 Langflow could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Affected products

Vendor	Product	Affected	Fixed
IBM	Langflow Desktop	≤ 1.8.4	—

Advisories 1

WID-SEC-2026-1340 IBM Langflow Desktop und OSS: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 3, 2026

References

https://www.ibm.com/support/pages/node/7271094 vendor-advisory patch