CVE-2026-4502Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API

Descripción

IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://www.ibm.com/support/pages/node/7271097 vendor-advisorypatchVendor Advisory