Executive brief
IBM Langflow OSS is a framework for building large language model applications. Versions 1.0.0 through 1.11.2 contain a path traversal vulnerability that allows authenticated users to read sensitive files from the server, including cryptographic keys, credentials, and application secrets. An attacker with login access can exploit the ChatInput, FileInput, and GitExtractor components to extract confidential data that should be restricted by access controls.
Technical details
This vulnerability is a path traversal (CWE-22) affecting multiple components in Langflow OSS. The ChatInput component's files parameter accepts absolute paths through the authenticated flow-build API and resolves them via Python pathlib join semantics without proper validation, allowing the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS security control to be bypassed. Similarly, FileInput components in bundles resolve paths without calling the local-file access guard before opening files. The GitExtractor component fails to validate symbolic links in cloned repositories, allowing symlinks pointing to absolute paths outside the intended tree to be followed. Exploitation requires prior authentication but no additional user interaction. An attacker can exfiltrate server secret material, JWT keys, application databases, environment variables, and other sensitive files. Patching to Langflow OSS version 1.11.3 or later resolves these issues.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-09-04: disclosed
- 2026-08-28: patched: Fix available in version 1.11.3