CVE-2026-7872CWE-22

Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass

High · published July 17, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00624 · 49.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-17T19:15Z
EPSS history
Timeline
  • 17 JUL 19:15Z
    Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass
    cvelistv5