Executive brief
IBM Langflow is an open-source platform for building AI workflows. Authenticated users can exploit improper validation of symbolic links in the GitExtractor component to read arbitrary files from the server, including secrets, keys, and configuration data. This bypasses security controls meant to restrict file access and could expose sensitive application credentials and data.
Technical details
This is a path traversal vulnerability (CWE-22) in the GitExtractor component of IBM Langflow OSS versions 1.0.0 through 1.11.2. The root cause is improper validation of symbolic links: while the component validates repository URLs to block local clones, it does not inspect the cloned tree for symbolic links. An attacker can craft a malicious remote repository containing absolute-path symlinks that cause the file-walk logic to follow those links and exfiltrate out-of-tree server files. The vulnerability requires authentication (PR:L) and network access, but has no user interaction requirement. An authenticated attacker can read arbitrary files accessible to the Langflow process, including secret keys, JWT signing keys, environment variables, and other sensitive application data. IBM recommends upgrading to version 1.11.3.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-08-28: disclosed
- 2026-09-04: patched: Fix available in version 1.11.3