Executive brief
IBM Langflow OSS, a tool used for building multi-agent AI applications, contains a security flaw in its APIRequest component. If the 'Save to File' feature is enabled, an attacker can trick the system into writing malicious files to sensitive locations on the server. In certain environments, such as Docker, this could allow an attacker to take full control of the system or disrupt operations.
Technical details
A path traversal vulnerability (CWE-22) exists in the APIRequest component of IBM Langflow OSS when the 'Save to File' feature is enabled. The vulnerability stems from improper sanitization of filenames extracted from the 'Content-Disposition' header of an HTTP response before they are joined to a temporary directory path. An attacker who controls an external HTTP server can return a response with a crafted filename containing traversal sequences (e.g., '../'). This allows the attacker to write arbitrary files to any location accessible by the Langflow process. In Docker-based deployments, this can be escalated to Remote Code Execution (RCE) by writing malicious .pth files to the Python site-packages directory, which are executed upon container restart.
Affected products
- IBM Langflow OSS 1.0.0-1.10.0
Timeline
- 2026-07-02: disclosed: Initial publication of the security bulletin by IBM
- 2026-07-02: patched: Fixed in version 1.10.1
- 2026-07-17: advisory: NVD publication date