CVE-2026-9138: Langflow path traversal enables

CISO Take

A flaw in Langflow's SaveToFileComponent lets an authenticated user — even one with just a low-privilege API key or session — supply crafted path values, including traversal sequences or absolute paths, that get written to disk without sanitization when a flow runs through the /api/v1/run/{flow_id} endpoint. This matters for any team running Langflow to orchestrate LLM agents or RAG pipelines, since the write occurs wherever the Langflow process has filesystem permissions, and depending on deployment (shared hosting, writable web roots, cron directories) it can escalate from a nuisance to a foothold for remote code execution. There's no public exploit, no CISA KEV listing, and no EPSS data yet, so this isn't being actively weaponized — but the low attack complexity (AC:L) and lack of required user interaction mean it's trivial to automate once an attacker has any valid credential, including a multi-tenant Langflow deployment where users only trust each other partially. IBM has published guidance at the referenced support page; patch to a fixed Langflow release once available, and in the meantime restrict SaveToFileComponent output paths, run Langflow under a low-privilege service account with a locked-down writable directory, and audit API keys/sessions for scope creep. Detection teams should watch for file writes from the Langflow process outside its expected output directory and flag flow definitions that reference absolute paths or '../' sequences in file-related components.

Sources:NVDATLASibm.com

What is the risk?

Medium severity (CVSS 6.5) reflects a high-integrity-impact, no-confidentiality/no-availability vulnerability that requires low-privileged authentication and no user interaction, over the network, with low attack complexity. Exploitability is straightforward for anyone with valid API/session access — this is a classic, well-understood path traversal pattern (CWE-22) applied to an AI orchestration component rather than a novel AI-specific attack. Real-world risk depends heavily on deployment posture: single-tenant, well-isolated Langflow instances face limited exposure, while multi-tenant or shared Langflow deployments (common in internal AI platform teams giving multiple developers API keys) face meaningful risk of one user compromising another's environment or escalating from file write to code execution. No KEV listing, no known public exploit or scanner template, and no EPSS data suggest this has not yet drawn attacker attention, but the simplicity of the bug makes rapid weaponization plausible once technical details circulate.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege Langflow API key or user session.

AML.T0012

Exploitation

Attacker crafts a flow using SaveToFileComponent with a path traversal or absolute-path payload and triggers it via POST to /api/v1/run/{flow_id}.

AML.T0049

Tool Abuse

Langflow executes the flow and invokes the vulnerable file-write component with attacker-controlled path input, writing content outside the intended directory.

AML.T0053

Impact

The written file is used to achieve persistence, defacement, or — if placed in an executable/web-servable location — remote code execution on the host.

Initial Access

Attacker authenticates with a low-privilege Langflow API key or user session.

AML.T0012

Exploitation

Attacker crafts a flow using SaveToFileComponent with a path traversal or absolute-path payload and triggers it via POST to /api/v1/run/{flow_id}.

AML.T0049

Tool Abuse

Langflow executes the flow and invokes the vulnerable file-write component with attacker-controlled path input, writing content outside the intended directory.

AML.T0053

Impact

The written file is used to achieve persistence, defacement, or — if placed in an executable/web-servable location — remote code execution on the host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 3d ago18% patched~75d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

1) Patch: upgrade Langflow past 1.11.2 as soon as IBM/Langflow publishes a fixed release (track the referenced IBM support page for the patched version number). 2) Workaround: audit all flows using SaveToFileComponent and restrict or hardcode output directories rather than allowing user/flow-controlled path input; disable or gate the component for untrusted users. 3) Least privilege: run the Langflow process under a dedicated low-privilege OS account with write access limited to a single, non-executable, non-web-servable directory. 4) Access control: review and rotate API keys/sessions with access to /api/v1/run/{flow_id}, and avoid sharing Langflow instances across trust boundaries without per-tenant isolation (containers/namespaces). 5) Detection: monitor filesystem writes from the Langflow process for paths outside the expected output directory, alert on '../' or absolute-path patterns in flow component configurations, and enable file integrity monitoring on directories reachable by the Langflow service account.

How is it classified?

Code ExecutionFrameworkAgentAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.2-AI system technical documentation and security controls

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-9138?

A flaw in Langflow's SaveToFileComponent lets an authenticated user — even one with just a low-privilege API key or session — supply crafted path values, including traversal sequences or absolute paths, that get written to disk without sanitization when a flow runs through the /api/v1/run/{flow_id} endpoint. This matters for any team running Langflow to orchestrate LLM agents or RAG pipelines, since the write occurs wherever the Langflow process has filesystem permissions, and depending on deployment (shared hosting, writable web roots, cron directories) it can escalate from a nuisance to a foothold for remote code execution. There's no public exploit, no CISA KEV listing, and no EPSS data yet, so this isn't being actively weaponized — but the low attack complexity (AC:L) and lack of required user interaction mean it's trivial to automate once an attacker has any valid credential, including a multi-tenant Langflow deployment where users only trust each other partially. IBM has published guidance at the referenced support page; patch to a fixed Langflow release once available, and in the meantime restrict SaveToFileComponent output paths, run Langflow under a low-privilege service account with a locked-down writable directory, and audit API keys/sessions for scope creep. Detection teams should watch for file writes from the Langflow process outside its expected output directory and flag flow definitions that reference absolute paths or '../' sequences in file-related components.

Is CVE-2026-9138 actively exploited?

No confirmed active exploitation of CVE-2026-9138 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-9138?

1) Patch: upgrade Langflow past 1.11.2 as soon as IBM/Langflow publishes a fixed release (track the referenced IBM support page for the patched version number). 2) Workaround: audit all flows using SaveToFileComponent and restrict or hardcode output directories rather than allowing user/flow-controlled path input; disable or gate the component for untrusted users. 3) Least privilege: run the Langflow process under a dedicated low-privilege OS account with write access limited to a single, non-executable, non-web-servable directory. 4) Access control: review and rotate API keys/sessions with access to /api/v1/run/{flow_id}, and avoid sharing Langflow instances across trust boundaries without per-tenant isolation (containers/namespaces). 5) Detection: monitor filesystem writes from the Langflow process for paths outside the expected output directory, alert on '../' or absolute-path patterns in flow component configurations, and enable file integrity monitoring on directories reachable by the Langflow service account.

What systems are affected by CVE-2026-9138?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model orchestration/flow pipelines.

What is the CVSS score for CVE-2026-9138?

CVE-2026-9138 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel orchestration/flow pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when handling requests to the /api/v1/run/{flow_id} endpoint. An attacker with low‑privileged authenticated access (such as a valid API key or user session) can supply crafted path values, including absolute paths or path traversal sequences, allowing arbitrary file writes to locations writable by the Langflow process. Successful exploitation may lead to unauthorized file creation or modification, potentially resulting in further compromise depending on the deployment environment.

Exploitation Scenario

An attacker obtains a low-privilege Langflow API key or user session — for example, a contractor account, a shared internal API key, or credentials leaked via a misconfigured CI pipeline. They craft a flow (or modify an existing one they have access to) that includes a SaveToFileComponent configured with a path traversal payload (e.g., '../../../var/www/html/shell.php' or an absolute path into a cron or startup directory), then trigger execution via a POST to /api/v1/run/{flow_id}. Langflow processes the request and writes the attacker-controlled content to the specified location without validating that it stays within an intended output directory. If the target directory is web-servable or otherwise executable, the attacker follows up by accessing the written file directly to achieve remote code execution, or by overwriting a configuration/cron file to gain persistence — escalating from a low-privilege API credential to full host compromise.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.