Critical · 9.8 CVE-2026-7524 EUVD-2026-32494GHSA-25hm-qrp9-f25g

Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution

Published May 27, 2026 · Updated May 28, 2026 · Assigned by ibm

Vendor: IBM Product: Langflow OSS

Description

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction.

Affected products

Vendor	Product	Affected	Fixed
IBM	Langflow OSS	1.0.0 – ≤ 1.9.1	—

Advisories 1

WID-SEC-2026-1713 Langflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 23, 2026

References

https://www.ibm.com/support/pages/node/7273426 vendor-advisory patch