4 matches found
CVE-2026-9225
IBM Langflow OSS 1.0.0 through 1.11.5 is affected by an authorization bypass (CWE-639) in the File/Read File component. When executing flows via the /api/v1/run/advanced/{flow_id} endpoint, component inputs can reference storage paths using arbitrary user or flow identifiers without verifying own...
EUVD-2026-75723
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...
CVE-2026-9225 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...