CVE-2026-42867

MEDIUM EPSS 19.7%

Published Jun 23, 20266d ago · Modified Jun 23, 20266d ago

6.5 CVSS 3.1

Medium

Published Jun 23, 2026 6d ago

Last Modified Jun 23, 2026 6d ago

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem. This vulnerability is fixed in 1.9.0.

CVSS Details

Base Score

6.5

Exploitability

3.9

Impact

2.5

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity Low

Availability Low

Threat Intelligence

EPSS Exploit Probability

19.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

References 2

github.com https://github.com/langflow-ai/langflow/pull/12337
github.com https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.