Vulnerability-Lookup

CVE-2026-42867 (GCVE-0-2026-42867)

Vulnerability from cvelistv5 – Published: 2026-06-23 16:29 – Updated: 2026-06-23 17:02

Title

Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

Summary

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem. This vulnerability is fixed in 1.9.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 17:01 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/langflow-ai/langflow/security/…	x_refsource_CONFIRM
https://github.com/langflow-ai/langflow/pull/12337	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
langflow-ai	langflow	Affected: < 1.9.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42867",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:01:29.364041Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:02:43.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "langflow",
          "vendor": "langflow-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server\u0027s filesystem. This vulnerability is fixed in 1.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T16:29:11.848Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
        },
        {
          "name": "https://github.com/langflow-ai/langflow/pull/12337",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langflow-ai/langflow/pull/12337"
        }
      ],
      "source": {
        "advisory": "GHSA-79ph-745m-6wxq",
        "discovery": "UNKNOWN"
      },
      "title": "Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42867",
    "datePublished": "2026-06-23T16:29:11.848Z",
    "dateReserved": "2026-04-30T18:49:06.710Z",
    "dateUpdated": "2026-06-23T17:02:43.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42867",
      "date": "2026-10-28",
      "epss": "0.00466",
      "percentile": "0.40271"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "langflow",
                "vendor": "langflow-ai",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.9.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D51A889E-5C89-4A92-B32B-C91EAF735430",
                    "versionEndExcluding": "1.9.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server\u0027s filesystem. This vulnerability is fixed in 1.9.0."
          },
          {
            "lang": "es",
            "value": "Langflow es una herramienta para construir y desplegar agentes y flujos de trabajo impulsados por IA. Antes de la 1.9.0, Langflow es vulnerable a salto de ruta en la API de Bases de Conocimiento (POST /api/v1/knowledge_bases). Esto ocurre porque los nombres de bases de conocimiento proporcionados por el usuario se utilizan directamente para crear rutas de archivo sin una sanitizaci\u00f3n o comprobaciones de contenci\u00f3n adecuadas. Un atacante autenticado puede explotar esta falla para crear directorios y escribir archivos en cualquier lugar del sistema de archivos del servidor. Esta vulnerabilidad est\u00e1 corregida en la 1.9.0."
          }
        ],
        "id": "CVE-2026-42867",
        "lastModified": "2026-10-26T11:10:00.157",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-42867",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:01:29.364041Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-23T17:16:58.857",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Issue Tracking"
            ],
            "url": "https://github.com/langflow-ai/langflow/pull/12337"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-42867",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-23T17:01:29.364041Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-23T17:01:48.325Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "langflow",
              "vendor": "langflow-ai",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.9.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server\u0027s filesystem. This vulnerability is fixed in 1.9.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-23T16:29:11.848Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
            },
            {
              "name": "https://github.com/langflow-ai/langflow/pull/12337",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/langflow-ai/langflow/pull/12337"
            }
          ],
          "source": {
            "advisory": "GHSA-79ph-745m-6wxq",
            "discovery": "UNKNOWN"
          },
          "title": "Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-42867",
        "datePublished": "2026-06-23T16:29:11.848Z",
        "dateReserved": "2026-04-30T18:49:06.710Z",
        "dateUpdated": "2026-06-23T17:02:43.824Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42867

Vulnerability from fkie_nvd - Published: 2026-06-23 17:16 - Updated: 2026-10-26 11:10

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/langflow-ai/langflow/pull/12337	Patch, Issue Tracking
security-advisories@github.com	https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	langflow	langflow	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "langflow",
          "vendor": "langflow-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D51A889E-5C89-4A92-B32B-C91EAF735430",
              "versionEndExcluding": "1.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server\u0027s filesystem. This vulnerability is fixed in 1.9.0."
    },
    {
      "lang": "es",
      "value": "Langflow es una herramienta para construir y desplegar agentes y flujos de trabajo impulsados por IA. Antes de la 1.9.0, Langflow es vulnerable a salto de ruta en la API de Bases de Conocimiento (POST /api/v1/knowledge_bases). Esto ocurre porque los nombres de bases de conocimiento proporcionados por el usuario se utilizan directamente para crear rutas de archivo sin una sanitizaci\u00f3n o comprobaciones de contenci\u00f3n adecuadas. Un atacante autenticado puede explotar esta falla para crear directorios y escribir archivos en cualquier lugar del sistema de archivos del servidor. Esta vulnerabilidad est\u00e1 corregida en la 1.9.0."
    }
  ],
  "id": "CVE-2026-42867",
  "lastModified": "2026-10-26T11:10:00.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42867",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-23T17:01:29.364041Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-23T17:16:58.857",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Issue Tracking"
      ],
      "url": "https://github.com/langflow-ai/langflow/pull/12337"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-79PH-745M-6WXQ

Vulnerability from github – Published: 2026-06-16 17:35 – Updated: 2026-07-20 13:41

Summary

Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

Details

Summary

Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.

Details

The vulnerability exists in the create_knowledge_base function within src/backend/base/langflow/api/v1/knowledge_bases.py.

This function constructs file paths directly from the user-supplied name field without sanitization. The value is concatenated with the user's base directory and passed directly to kb_path.mkdir(). Immediately following the directory creation, the application writes embedding_metadata.json and schema.json into this attacker-controlled path.

PoC (Proof of Concept)

For the Create endpoint, an attacker can supply traversal sequences or absolute paths in the name field:

../victim_user/evil_kb or /tmp/pwned

This forces kb_path.mkdir() to create directories and write specific application files (embedding_metadata.json and schema.json) at any reachable path on the server.

Impact

Any Langflow instance exposing this endpoint to authenticated users is vulnerable. This exposes the server to: * Cross-user data compromise: Creation of directories and files within another tenant's knowledge base space. * Arbitrary filesystem manipulation: Directory creation at any path on the server where the application has write permissions (e.g., /app/data). * Data overwrite: Overwriting existing embedding_metadata.json and schema.json files in attacker-targeted paths, potentially corrupting existing knowledge bases.

Fixes

The issue was addressed in PR #12337. The fix introduces the _validate_kb_path_containment() helper function, which uses Path.is_relative_to() instead of startswith() to enforce strict path boundaries and prevent prefix-ambiguity bugs. This helper is applied before any filesystem operations. Regression tests were added to verify that traversal payloads return a 403 Forbidden.

Acknowledgements

Thanks to the security researchers who responsibly disclosed this vulnerability: * @ddlxstudio * @nekros1xx

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.8.4"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42867"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-16T17:35:09Z",
    "nvd_published_at": "2026-06-23T17:16:58Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nLangflow is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server\u0027s filesystem.\n\n## Details\nThe vulnerability exists in the `create_knowledge_base` function within `src/backend/base/langflow/api/v1/knowledge_bases.py`. \n\nThis function constructs file paths directly from the user-supplied `name` field without sanitization. The value is concatenated with the user\u0027s base directory and passed directly to `kb_path.mkdir()`. Immediately following the directory creation, the application writes `embedding_metadata.json` and `schema.json` into this attacker-controlled path.\n\n## PoC (Proof of Concept)\nFor the **Create** endpoint, an attacker can supply traversal sequences or absolute paths in the `name` field:\n\n`../victim_user/evil_kb`\nor\n`/tmp/pwned`\n\nThis forces `kb_path.mkdir()` to create directories and write specific application files (`embedding_metadata.json` and `schema.json`) at any reachable path on the server.\n\n## Impact\nAny Langflow instance exposing this endpoint to authenticated users is vulnerable. This exposes the server to:\n* **Cross-user data compromise:** Creation of directories and files within another tenant\u0027s knowledge base space.\n* **Arbitrary filesystem manipulation:** Directory creation at any path on the server where the application has write permissions (e.g., `/app/data`).\n* **Data overwrite:** Overwriting existing `embedding_metadata.json` and `schema.json` files in attacker-targeted paths, potentially corrupting existing knowledge bases.\n\n## Fixes\nThe issue was addressed in **PR #12337**. The fix introduces the `_validate_kb_path_containment()` helper function, which uses `Path.is_relative_to()` instead of `startswith()` to enforce strict path boundaries and prevent prefix-ambiguity bugs. This helper is applied before any filesystem operations. Regression tests were added to verify that traversal payloads return a `403 Forbidden`.\n\n## Acknowledgements\nThanks to the security researchers who responsibly disclosed this vulnerability:\n* @ddlxstudio\n* @nekros1xx",
  "id": "GHSA-79ph-745m-6wxq",
  "modified": "2026-07-20T13:41:52Z",
  "published": "2026-06-16T17:35:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42867"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/12337"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-79ph-745m-6wxq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2026-2566.yaml"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/langflow"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint"
}

PYSEC-2026-2566

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:04

Details

Summary

Details

The vulnerability exists in the create_knowledge_base function within src/backend/base/langflow/api/v1/knowledge_bases.py.

PoC (Proof of Concept)

For the Create endpoint, an attacker can supply traversal sequences or absolute paths in the name field:

../victim_user/evil_kb or /tmp/pwned

This forces kb_path.mkdir() to create directories and write specific application files (embedding_metadata.json and schema.json) at any reachable path on the server.

Impact

Fixes

Acknowledgements

Thanks to the security researchers who responsibly disclosed this vulnerability: * @ddlxstudio * @nekros1xx

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Impacted products

Name	purl
langflow	pkg:pypi/langflow

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow",
        "purl": "pkg:pypi/langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.31",
        "0.0.32",
        "0.0.33",
        "0.0.40",
        "0.0.44",
        "0.0.45",
        "0.0.46",
        "0.0.52",
        "0.0.53",
        "0.0.54",
        "0.0.55",
        "0.0.56",
        "0.0.57",
        "0.0.58",
        "0.0.61",
        "0.0.62",
        "0.0.63",
        "0.0.64",
        "0.0.65",
        "0.0.66",
        "0.0.67",
        "0.0.68",
        "0.0.69",
        "0.0.70",
        "0.0.71",
        "0.0.72",
        "0.0.73",
        "0.0.74",
        "0.0.75",
        "0.0.76",
        "0.0.78",
        "0.0.79",
        "0.0.80",
        "0.0.81",
        "0.0.83",
        "0.0.84",
        "0.0.85",
        "0.0.86",
        "0.0.87",
        "0.0.88",
        "0.0.89",
        "0.1.0",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.2.0",
        "0.2.1",
        "0.2.10",
        "0.2.11",
        "0.2.12",
        "0.2.13",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.5",
        "0.2.6",
        "0.2.7",
        "0.2.8",
        "0.2.9",
        "0.3.0",
        "0.3.1",
        "0.3.2",
        "0.3.3",
        "0.3.4",
        "0.4.0",
        "0.4.1",
        "0.4.10",
        "0.4.11",
        "0.4.12",
        "0.4.14",
        "0.4.15",
        "0.4.16",
        "0.4.17",
        "0.4.18",
        "0.4.19",
        "0.4.2",
        "0.4.20",
        "0.4.21",
        "0.4.3",
        "0.4.4",
        "0.4.5",
        "0.4.6",
        "0.4.7",
        "0.4.8",
        "0.4.9",
        "0.5.0",
        "0.5.0a0",
        "0.5.0a1",
        "0.5.0a2",
        "0.5.0a3",
        "0.5.0a4",
        "0.5.0a5",
        "0.5.0a6",
        "0.5.0b0",
        "0.5.0b2",
        "0.5.0b3",
        "0.5.0b4",
        "0.5.0b5",
        "0.5.0b6",
        "0.5.1",
        "0.5.10",
        "0.5.11",
        "0.5.12",
        "0.5.2",
        "0.5.3",
        "0.5.4",
        "0.5.5",
        "0.5.6",
        "0.5.7",
        "0.5.8",
        "0.5.9",
        "0.6.0",
        "0.6.0rc1",
        "0.6.1",
        "0.6.10",
        "0.6.11",
        "0.6.12",
        "0.6.14",
        "0.6.15",
        "0.6.16",
        "0.6.17",
        "0.6.18",
        "0.6.19",
        "0.6.2",
        "0.6.3",
        "0.6.3a0",
        "0.6.3a1",
        "0.6.3a2",
        "0.6.3a3",
        "0.6.3a4",
        "0.6.3a5",
        "0.6.3a6",
        "0.6.3a7",
        "0.6.4",
        "0.6.4a0",
        "0.6.4a1",
        "0.6.5",
        "0.6.5a0",
        "0.6.5a1",
        "0.6.5a10",
        "0.6.5a11",
        "0.6.5a12",
        "0.6.5a13",
        "0.6.5a2",
        "0.6.5a3",
        "0.6.5a4",
        "0.6.5a5",
        "0.6.5a6",
        "0.6.5a7",
        "0.6.5a8",
        "0.6.5a9",
        "0.6.6",
        "0.6.7",
        "0.6.7a1",
        "0.6.7a2",
        "0.6.7a3",
        "0.6.7a5",
        "0.6.8",
        "0.6.9",
        "1.0.0",
        "1.0.0a0",
        "1.0.0a1",
        "1.0.0a10",
        "1.0.0a11",
        "1.0.0a12",
        "1.0.0a13",
        "1.0.0a14",
        "1.0.0a15",
        "1.0.0a17",
        "1.0.0a18",
        "1.0.0a19",
        "1.0.0a2",
        "1.0.0a20",
        "1.0.0a21",
        "1.0.0a22",
        "1.0.0a23",
        "1.0.0a24",
        "1.0.0a25",
        "1.0.0a26",
        "1.0.0a27",
        "1.0.0a28",
        "1.0.0a29",
        "1.0.0a3",
        "1.0.0a30",
        "1.0.0a31",
        "1.0.0a32",
        "1.0.0a33",
        "1.0.0a34",
        "1.0.0a35",
        "1.0.0a36",
        "1.0.0a37",
        "1.0.0a38",
        "1.0.0a39",
        "1.0.0a4",
        "1.0.0a40",
        "1.0.0a41",
        "1.0.0a42",
        "1.0.0a43",
        "1.0.0a44",
        "1.0.0a45",
        "1.0.0a46",
        "1.0.0a47",
        "1.0.0a48",
        "1.0.0a49",
        "1.0.0a5",
        "1.0.0a50",
        "1.0.0a51",
        "1.0.0a52",
        "1.0.0a53",
        "1.0.0a55",
        "1.0.0a56",
        "1.0.0a57",
        "1.0.0a58",
        "1.0.0a59",
        "1.0.0a6",
        "1.0.0a60",
        "1.0.0a61",
        "1.0.0a7",
        "1.0.0a8",
        "1.0.0a9",
        "1.0.0rc0",
        "1.0.0rc1",
        "1.0.1",
        "1.0.10",
        "1.0.11",
        "1.0.12",
        "1.0.13",
        "1.0.14",
        "1.0.15",
        "1.0.16",
        "1.0.17",
        "1.0.18",
        "1.0.19",
        "1.0.19.post1",
        "1.0.19.post2",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.7",
        "1.0.8",
        "1.0.9",
        "1.1.0",
        "1.1.1",
        "1.1.2",
        "1.1.3",
        "1.1.4",
        "1.1.4.post1",
        "1.2.0",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.4.0",
        "1.4.1",
        "1.4.2",
        "1.4.3",
        "1.5.0",
        "1.5.0.post1",
        "1.5.0.post2",
        "1.5.1",
        "1.6.0",
        "1.6.1",
        "1.6.2",
        "1.6.3",
        "1.6.4",
        "1.6.5",
        "1.6.6",
        "1.6.7",
        "1.6.8",
        "1.6.9",
        "1.7.0",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.8.0",
        "1.8.0rc0",
        "1.8.0rc1",
        "1.8.0rc2",
        "1.8.0rc3",
        "1.8.0rc4",
        "1.8.0rc5",
        "1.8.0rc6",
        "1.8.1",
        "1.8.2",
        "1.8.3",
        "1.8.3rc0",
        "1.8.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42867",
    "GHSA-79ph-745m-6wxq"
  ],
  "details": "## Summary\nLangflow is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server\u0027s filesystem.\n\n## Details\nThe vulnerability exists in the `create_knowledge_base` function within `src/backend/base/langflow/api/v1/knowledge_bases.py`. \n\nThis function constructs file paths directly from the user-supplied `name` field without sanitization. The value is concatenated with the user\u0027s base directory and passed directly to `kb_path.mkdir()`. Immediately following the directory creation, the application writes `embedding_metadata.json` and `schema.json` into this attacker-controlled path.\n\n## PoC (Proof of Concept)\nFor the **Create** endpoint, an attacker can supply traversal sequences or absolute paths in the `name` field:\n\n`../victim_user/evil_kb`\nor\n`/tmp/pwned`\n\nThis forces `kb_path.mkdir()` to create directories and write specific application files (`embedding_metadata.json` and `schema.json`) at any reachable path on the server.\n\n## Impact\nAny Langflow instance exposing this endpoint to authenticated users is vulnerable. This exposes the server to:\n* **Cross-user data compromise:** Creation of directories and files within another tenant\u0027s knowledge base space.\n* **Arbitrary filesystem manipulation:** Directory creation at any path on the server where the application has write permissions (e.g., `/app/data`).\n* **Data overwrite:** Overwriting existing `embedding_metadata.json` and `schema.json` files in attacker-targeted paths, potentially corrupting existing knowledge bases.\n\n## Fixes\nThe issue was addressed in **PR #12337**. The fix introduces the `_validate_kb_path_containment()` helper function, which uses `Path.is_relative_to()` instead of `startswith()` to enforce strict path boundaries and prevent prefix-ambiguity bugs. This helper is applied before any filesystem operations. Regression tests were added to verify that traversal payloads return a `403 Forbidden`.\n\n## Acknowledgements\nThanks to the security researchers who responsibly disclosed this vulnerability:\n* @ddlxstudio\n* @nekros1xx",
  "id": "PYSEC-2026-2566",
  "modified": "2026-07-13T16:04:31.853417Z",
  "published": "2026-07-13T15:46:17.991583Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-79ph-745m-6wxq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/12337"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/langflow"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-79ph-745m-6wxq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42867"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint"
}

WID-SEC-W-2026-1898

Vulnerability from csaf_certbund - Published: 2026-06-11 22:00 - Updated: 2026-06-11 22:00

Summary

Langflow: Mehrere Schwachstellen

Severity

Hoch

Scope

2 vulnerabilities in this advisory, including CVE-2026-42867.

CVE-2026-42867

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-42867 (GCVE-0-2026-42867)

FKIE_CVE-2026-42867

GHSA-79PH-745M-6WXQ

Summary

Details

PoC (Proof of Concept)

Impact

Fixes

Acknowledgements

PYSEC-2026-2566

Summary

Details

PoC (Proof of Concept)

Impact

Fixes

Acknowledgements

WID-SEC-W-2026-1898

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour