Executive brief
IBM Langflow OSS, a tool used to build and manage AI workflows, contains a security flaw that allows an authorized user to write malicious files to the server. By connecting a workflow to a server they control, an attacker can trick the system into saving files in restricted folders. This could allow an attacker to take full control of the server, disrupt operations, or access sensitive data.
Technical details
A path traversal vulnerability (CWE-22) exists in the API Request component of IBM Langflow OSS. When the 'save_to_file' option is enabled, the application fails to properly sanitize the 'filename' parameter within the 'Content-Disposition' header of a server response. An authenticated attacker can create a malicious flow that connects to an attacker-controlled URL; when the flow is executed, the attacker's server returns a crafted header (e.g., filename="../../../target/path") to write arbitrary content to any location accessible by the Langflow process. This can be leveraged to achieve remote code execution by overwriting critical system files like SSH keys or configuration scripts. The issue is fixed in version 1.10.1.
Affected products
- IBM Langflow OSS 1.0.0 - 1.10.0
Timeline
- 2026-07-02: disclosed: Initial publication by IBM
- 2026-07-17: advisory: NVD publication date
- 2026-07-02: patched: Version 1.10.1 released