CVE-2026-51888 in Langflow
Summary
by MITRE • 10/02/2026
langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is: src/backend/base/langflow/api/v1/knowledge_bases.py:knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge-base. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing upload or HTTP route handler forwards an attacker-controlled path or filename into host file creation without any visible boundary enforcement. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.8.4. langflow contains an absolute path traversal vulnerability in knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge-base (src/backend/base/langflow/api/v1/knowledge_bases.py:51). An attacker can write or overwrite files outside the intended working directory by providing absolute paths in the knowledge base creation endpoint.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified within langflow-ai version 1.8.4 and earlier represents a critical security flaw classified as Directory Traversal, specifically manifesting through an arbitrary file write mechanism that allows attackers to bypass intended storage boundaries. This issue resides in the backend component responsible for creating knowledge bases, located at src/backend/base/langflow/api/v1/knowledge_bases.py on line 51 within the function associated with the live HTTP POST request handler for knowledge base creation. The core technical flaw stems from insufficient validation of user-supplied input when constructing file paths during the initialization process. When a client submits data to this endpoint, the application incorporates provided path or filename parameters directly into host file operations without enforcing strict boundary checks against absolute directory structures. This lack of sanitization enables an attacker to manipulate the resulting file system location by supplying absolute paths rather than relative ones, effectively neutralizing any implicit containment mechanisms designed to keep files within a designated workspace or storage root.
From an operational perspective, this vulnerability poses severe risks due to its potential for arbitrary file write outside the intended working directory. An adversary exploiting this flaw can overwrite critical system configuration files, inject malicious scripts into executable directories, or corrupt essential application data located in sensitive areas of the host operating system. The attack vector is accessible via HTTP or browser-backed service paths, meaning that any user with access to the public-facing upload route handler can attempt exploitation without requiring prior authentication if the endpoint is publicly exposed. Even if authentication is required, the high privilege level often associated with administrative functions like knowledge base management increases the likelihood of successful compromise and subsequent impact on system integrity. The ability to write files outside the sandboxed environment undermines the principle of least privilege and isolation, potentially leading to remote code execution depending on which specific file paths are targeted and what permissions the application process holds on those locations.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal, and CWE-436: Interpretation Error, which highlights issues arising from ambiguous interpretation of user input leading to security vulnerabilities. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques related to Defense Evasion by allowing attackers to place malicious artifacts in unexpected locations to avoid detection, as well as Persistence if critical system files are overwritten with backdoors or modified startup scripts. The exploitation chain typically involves crafting a specially formatted HTTP POST request where the path parameter contains sequences like ../..// followed by an absolute path such as /etc/passwd on Linux systems or C:\Windows\System32\drivers\etc\hosts on Windows, thereby directing file creation operations to unintended destinations controlled by the attacker.
Mitigation strategies must prioritize immediate patching of langflow-ai to version 1.8.5 or later where this issue has been addressed through rigorous input validation and path canonicalization techniques. Developers should implement strict allow-lists for permitted characters in filenames and enforce relative path resolution that is strictly bound within the designated application workspace directory using functions like os.path.realpath combined with startswith checks against a configured base directory. Additionally, employing sandboxing mechanisms such as chroot jails or containerized environments can limit the blast radius of any successful exploitation attempt by restricting file system access at the operating system level rather than relying solely on application-level logic. Security monitoring should also be enhanced to detect anomalous file creation patterns in sensitive directories that originate from web service processes, providing an additional layer of defense against active exploitation attempts targeting this specific endpoint.