Executive brief
IBM Langflow OSS is an open-source platform for building AI applications. An authenticated attacker can delete arbitrary files and directories on the server due to insufficient validation of file paths. This could result in loss of critical data, deletion of cryptographic keys, or operational disruption if system files are removed.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in Langflow's SaveToFileComponent and file-handling logic. When processing requests to the /api/v1/run/{flow_id} endpoint, the application constructs file paths directly from attacker-controlled input in the tweaks parameter without proper validation or confinement. An authenticated attacker can supply absolute paths or parent-directory traversal sequences (e.g., "../../../") to delete arbitrary files and directories on the filesystem accessible to the Langflow process. The issue is particularly severe when S3 storage mode is enabled, as path validation is bypassed and the delete-after-processing flag (enabled by default) invokes deletion on raw user-supplied paths. The attack requires prior authentication but no additional user interaction.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Version 1.11.3 available