6.5Medium
CVE-2026-4502Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API
Description
IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.
Weakness (CWE):
CWE-22
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| IBM | Langflow Desktop | 1.2.0 – ≤ 1.8.4 | |
| langflow | langflow desktop | 1.2.0 – ≤ 1.8.4 |
References and patches
- https://www.ibm.com/support/pages/node/7271097 vendor-advisorypatchVendor Advisory
CPE matches (NVD) (1)
cpe:2.3:a:langflow:langflow_desktop:*:*:*:*:*:*:*:*≥ 1.2.0 ≤ 1.8.4