Directory Traversal Vulnerability in Langflow by Langflow-AI
CVE-2026-51888

7.5HIGH

Key Information:

Vendor

Langflow-AI

Status
Langflow
Vendor
CVE Published:
1 October 2026

What is CVE-2026-51888?

A directory traversal vulnerability exists in Langflow v1.8.4 that allows attackers to exploit a flaw within the knowledge base creation endpoint. By submitting specially crafted HTTP requests with absolute paths, an attacker can write or overwrite files outside the designated workspace, thereby compromising system integrity. This vulnerability arises due to insufficient boundary checks when processing file paths, exposing the application to potential file manipulation attacks that could impact sensitive data and application functionality.

References

https://gist.github.com/Ro1ME/c85f513d1fd702c686cffe061cb...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.