Executive brief
Langflow, a tool for building AI-powered workflows, contains a security flaw in its Knowledge Bases API. An authenticated user can exploit this vulnerability to delete arbitrary folders and files across the server's entire storage system. This can lead to permanent data loss, the deletion of other users' work, and significant service outages.
Technical details
A path traversal vulnerability exists in the `delete_knowledge_bases_bulk` function within `src/backend/base/langflow/api/v1/knowledge_bases.py`. The endpoint `DELETE /api/v1/knowledge_bases` fails to sanitize the `kb_names` parameter, concatenating user input directly into file paths used by `shutil.rmtree()`. By supplying traversal sequences (e.g., `../`), an authenticated attacker can bypass intended directory boundaries to delete any directory the application process has permissions to modify. The vulnerability was fixed in version 1.9.0 by implementing path normalization and strict containment checks using `Path.is_relative_to()`.
Affected products
- langflow-ai Langflow < 1.9.0
Timeline
- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE-2026-42048 published to NVD