CVE-2026-77819: Langflow: path traversal allows arbitrary file overwrite

MEDIUM

Published October 29, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.3 has a path traversal flaw (CWE-22) that lets any authenticated user overwrite arbitrary files on the server by escaping the intended directory. The CVSS score is a moderate 6.5, but the integrity impact is high, and overwriting files on an AI workflow host can lead to tampered flows, altered configuration or, in some deployments, code execution. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data yet, so exploitation is not currently observed, but the low complexity and low privilege requirement make it easy to weaponize once details circulate. Upgrade to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015), restrict Langflow to trusted users and networks until then, and review file-write activity from the Langflow service account.

Sources:NVDibm.comATLAS

What is the risk?

Medium overall (CVSS 3.1: 6.5). The attack is network-reachable, low complexity, needs no user interaction and only low privileges (any valid account). Impact is limited to integrity (I:H) with no direct confidentiality or availability loss in the vector. Real-world risk rises in multi-user or internet-exposed Langflow instances where self-registration or shared accounts are enabled, because arbitrary file overwrite can be chained into code execution (for example by overwriting scripts, configs or Python modules loaded by the service). No exploitation evidence, no public PoC and no EPSS score are available, so likelihood is currently assessed as low to moderate. Downstream dependents and package risk data are unknown.

How does the attack unfold?

Initial Access

Attacker authenticates to Langflow with a low-privilege account obtained via weak credentials or open registration.

AML.T0012

Exploitation

Attacker sends a request with path traversal sequences in a file path parameter to escape the restricted directory.

AML.T0049

Arbitrary File Overwrite

The server overwrites a targeted file such as a flow, component, script or configuration with attacker-controlled content.

Impact

Tampered flows or configuration alter AI application behavior and may lead to code execution and theft of API keys.

Initial Access

Attacker authenticates to Langflow with a low-privilege account obtained via weak credentials or open registration.

AML.T0012

Exploitation

Attacker sends a request with path traversal sequences in a file path parameter to escape the restricted directory.

AML.T0049

Arbitrary File Overwrite

The server overwrites a targeted file such as a flow, component, script or configuration with attacker-controlled content.

Impact

Tampered flows or configuration alter AI application behavior and may lead to code execution and theft of API keys.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

1) Upgrade IBM Langflow OSS to the fixed version specified in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are affected. 2) Until patched, limit access to Langflow to trusted users, disable open self-registration, and place the service behind a VPN or an authenticating reverse proxy. 3) Run Langflow as a non-root user in a container with a read-only root filesystem and writable mounts limited to the data directory. 4) Add WAF or proxy rules to block path traversal patterns (../, encoded variants like %2e%2e%2f) in file-related API parameters. 5) Monitor for unexpected file modifications outside the Langflow data directory using file integrity monitoring, and review application logs for requests containing traversal sequences. 6) Rotate LLM provider keys and secrets if suspicious file changes are found.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-77819?

Is CVE-2026-77819 actively exploited?

No confirmed active exploitation of CVE-2026-77819 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77819?

1) Upgrade IBM Langflow OSS to the fixed version specified in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are affected. 2) Until patched, limit access to Langflow to trusted users, disable open self-registration, and place the service behind a VPN or an authenticating reverse proxy. 3) Run Langflow as a non-root user in a container with a read-only root filesystem and writable mounts limited to the data directory. 4) Add WAF or proxy rules to block path traversal patterns (../, encoded variants like %2e%2e%2f) in file-related API parameters. 5) Monitor for unexpected file modifications outside the Langflow data directory using file integrity monitoring, and review application logs for requests containing traversal sequences. 6) Rotate LLM provider keys and secrets if suspicious file changes are found.

What systems are affected by CVE-2026-77819?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms, low-code AI workflow builders.

What is the CVSS score for CVE-2026-77819?

CVE-2026-77819 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration platformslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, either through weak credentials, a shared team account or open registration. They call a file upload or file-handling endpoint with a crafted filename containing traversal sequences such as ../../ to escape the intended storage directory. The server writes attacker-controlled content to an arbitrary path, such as a Python component, startup script or configuration file used by the Langflow process. On the next load or restart, the modified file executes or changes agent behavior, allowing the attacker to exfiltrate API keys, manipulate flow logic or pivot deeper into the environment.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.