CVE-2026-4502CWE-22

Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API

Medium · published April 30, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00409 · 34.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-30T20:57Z
EPSS history
Timeline
  • 30 APR 20:57Z
    Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API
    cvelistv5