File Access Control Flaw in IBM Langflow Software

CVE-2026-9225

What is CVE-2026-9225?

IBM Langflow versions 1.0.0 through 1.11.5 are susceptible to an improper access control vulnerability in the File/Read File component. An authenticated attacker with low privileges can exploit this flaw by providing a malicious file path during flow execution at the /api/v1/run/advanced/{flow_id} endpoint. This oversight allows the attacker to access the storage paths of other users, thus gaining unauthorized access to sensitive files and potentially exposing confidential user information. The failure to verify ownership against the file management API's intended authorization checks presents severe privacy risks.

References