{"id":"CVE-2026-77819","kind":"vulnerability","aliases":["CVE-2026-77819"],"related":[],"title":"Langflow: authenticated users can overwrite arbitrary files on the server","description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to restrict file paths to their intended directory. A remote attacker with a valid account can overwrite arbitrary files on the server.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-apps","ai-tooling","langflow","self-hosted"],"not_affected_if":["no-user-accounts","version-outside-range"],"how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow`, and see whether it falls in 1.0.0 through 1.12.3.\n- Confirm whether user accounts can reach the server over the network, since an account is needed to exploit this.","fix":"- Langflow OSS: move to a version later than `1.12.3`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-10-29T16:18:52+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:31:18+00:00","updated_at":"2026-10-29T16:31:18+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:31:18Z","model":"claude-haiku-5-5","output":{"fix":"- Langflow OSS: move to a version later than `1.12.3`; the sources do not name the exact fixed release.","reach":"network","title":"Langflow: authenticated users can overwrite arbitrary files on the server","impact":"high","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to restrict file paths to their intended directory. A remote attacker with a valid account can overwrite arbitrary files on the server.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","ai-apps"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker overwrites arbitrary server files, possibly enabling code execution","analyst_note":"Check the IBM security bulletin for the fixed version and whether the flaw is reachable by default; NVD text alone gives no fix.","how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow`, and see whether it falls in 1.0.0 through 1.12.3.\n- Confirm whether user accounts can reach the server over the network, since an account is needed to exploit this.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range","no-user-accounts"],"who_is_affected":"Teams running self-hosted IBM Langflow OSS between 1.0.0 and 1.12.3 where users can log in over the network. The sources do not say whether managed or hosted Langflow deployments are affected, so those should be checked with the provider.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4108,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77819':13A,16A '1.0.0':31B,60C '1.12.3':33B,62C 'account':49B 'ai':18B,21B 'ai-app':17B 'ai-tool':20B 'allow':64C 'app':19B 'arbitrari':6A,52B,71C 'attack':45B,68C 'authent':2A,67C 'could':63C 'cve':11A,14A 'directori':42B,83C 'due':73C 'fail':34B 'file':7A,37B,53B,72C 'host':26B 'ibm':27B,57C 'improp':75C 'intend':41B 'langflow':1A,23B,28B,58C 'limit':76C 'oss':29B,59C 'overwrit':5A,51B,70C 'path':38B 'pathnam':79C 'remot':44B,66C 'restrict':36B,82C 'self':25B 'self-host':24B 'server':10A,56B 'tool':22B 'user':3A 'valid':48B 'version':30B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM Langflow OSS between 1.0.0 and 1.12.3 where users can log in over the network. The sources do not say whether managed or hosted Langflow deployments are affected, so those should be checked with the provider.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77819","severity":null,"published_at":"2026-10-29T16:18:52+00:00","modified_at":"2026-10-29T16:18:53+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}