Live › vulnerability › CVE-2026-77819
IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to restrict file paths to their intended directory. A remote attacker with a valid account can overwrite arbitrary files on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Teams running self-hosted IBM Langflow OSS between 1.0.0 and 1.12.3 where users can log in over the network. The sources do not say whether managed or hosted Langflow deployments are affected, so those should be checked with the provider.
No product ranges from the sources yet.
langflow --version or pip show langflow, and see whether it falls in 1.0.0 through 1.12.3.1.12.3; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-77819")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.