CVE-2026-103360 in Langflow OSS
Summary
by MITRE • 10/07/2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in IBM Langflow versions 1.0.0 through 1.12.2 represents a critical security flaw rooted in the application's handling of file system paths, specifically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This class of vulnerabilities is commonly known as path traversal or directory traversal. In this specific context, the software fails to adequately sanitize or validate user-supplied input that dictates which files are accessed by the application. When an authenticated attacker provides a maliciously crafted pathname containing sequences such as dot-dot-slash (../) or other platform-specific escape characters, they can manipulate the internal file resolution logic of Langflow. This manipulation allows the application to resolve paths outside of its intended restricted directory structure, effectively bypassing access controls that are designed to isolate sensitive data from general user operations.
From a technical perspective, this flaw exploits the lack of rigorous canonicalization and boundary checking within the server-side components responsible for file retrieval or management. While Langflow is an open-source project often used for building large language model applications, its underlying infrastructure may rely on standard web framework features that assume input validity unless explicitly constrained. The vulnerability arises because the application does not strictly enforce a whitelist of allowed directories nor does it properly normalize paths to resolve symbolic links and relative references before performing file system operations. Consequently, an attacker who has successfully authenticated into the Langflow instance can construct requests that traverse up the directory hierarchy from the web root or application base path. This capability is particularly dangerous because authentication serves as the primary barrier in this scenario; once inside the perimeter, the lack of strict output encoding and input validation transforms a standard file access feature into an arbitrary read vector.
The operational impact of this vulnerability is significant for organizations deploying Langflow to handle sensitive data or integrate with proprietary models and datasets. An attacker leveraging this flaw can potentially exfiltrate configuration files that contain database credentials, API keys, secret tokens, or other authentication material stored on the server's file system. Beyond credential theft, the ability to read arbitrary files may reveal internal network topology details, source code containing hardcoded secrets, or logs that expose user activity and sensitive business logic. This information disclosure can serve as a stepping stone for further attacks, such as privilege escalation if additional credentials are found in configuration files, or supply chain compromise if critical application binaries or scripts are tampered with after being read. The severity is compounded by the fact that Langflow is often deployed in environments where AI models process sensitive corporate data, making any leakage of infrastructure details a high-risk event for confidentiality and integrity.
Mitigation strategies must address both immediate remediation and long-term secure coding practices. For administrators currently running affected versions, the most effective mitigation is to upgrade IBM Langflow to version 1.12.3 or later, where this path limitation issue has been resolved through improved input validation and stricter directory isolation mechanisms. In environments where upgrading is not immediately feasible, network-level controls such as web application firewalls can be configured to detect and block requests containing common traversal patterns like ../ in URL parameters or file paths. Additionally, implementing strict least-privilege principles for the user account running the Langflow service ensures that even if an attacker succeeds in reading files outside the intended directory, they are limited by the operating system permissions of that specific process. Developers integrating Langflow should also ensure that any custom extensions or plugins adhere to similar secure coding standards, validating all file paths against a predefined allowlist and using absolute path resolution libraries that prevent traversal attacks. Regular security audits focusing on CWE-22 patterns across the application stack are recommended to maintain robust defense-in-depth posture.