nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-7869 CVE-2026-7869
MEDIUM
Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
Record summary
CVE-2026-7869 has a selected CVSS score of 5.4 (medium).
Description
IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 6, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Langflow OSSBrowse IBM / Langflow OSS | CVE List | 1.0.0 to ≤ 1.10.3 | affected |
References
2ibm.comVendor advisorypatch
https://www.ibm.com/support/pages/node/7282647