Executive brief
IBM Langflow is an open-source application orchestration platform used to build and deploy AI-powered workflows. An authenticated attacker can exploit path traversal vulnerabilities in file-upload components to read arbitrary files from the server, including encryption keys, database files, and configuration secrets. This data is then transmitted to external language model endpoints, resulting in complete compromise of server secrets and access to other users' data.
Technical details
The vulnerability is a path traversal flaw (CWE-22) affecting multiple file-reading components in Langflow OSS versions 1.0.0 through 1.11.2. The ChatInput component's files parameter accepts absolute paths and traversal sequences in authenticated build requests; due to Python pathlib semantics, absolute path segments reset the path context, allowing reads outside the intended directory. The message attachment pipeline then embeds file contents as text in language model prompts without validating the access guard (LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS). Similarly, Bundle FileInput and GitExtractor components fail to enforce the local-file access guard, enabling exfiltration of secrets, JWT keys, databases, and environment variables to attacker-controlled model endpoints. The attack requires prior authentication but no additional user interaction. IBM recommends upgrading to version 1.11.3 or later.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-09-04: disclosed
- 2026-08-28: patched: Fix available in version 1.11.3