LangflowPublished 29 Oct 2026NVD status: Analyzed

CVE-2026-110190

IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system.

ComponentLangflow
Severitymedium (CVSS 6.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published (NVD)2026-10-29
Last modified2026-10-30
Affected versions
>= 1.0.0, < 1.12.5
Fixed in1.12.5
WeaknessCWE-22
CISA KEVnot listed

Versions, checked against NVD

These are NVD's ranges. Neither a GitHub-reviewed advisory nor the CVE record gives versions to check them against yet.

NVD description

IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.

What to do

  • Upgrade Langflow to 1.12.5 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more