CVE-2026-19299

IBM Langflow OSS versions 1.0.0 through 1.11.2 is affected by an authenticated path traversal vulnerability (CWE-22) in the ChatInput , bundle FileInput , and GitExtractor components. The root cause is that these components resolve file paths without invoking the LANGFLOW_RESTRICT_LOCAL_FILE_ACCE...

CVE-2026-19299 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal...

CVE-2026-19302

IBM Langflow OSS versions 1.0.0 through 1.11.2 are vulnerable to information disclosure via improper symbolic link validation in the GitExtractor component. While the component validates repository URLs to block local clones, it does not inspect the cloned tree for symbolic links. An attacker-con...

CVE-2026-19302 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

CVE-2026-19302 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

CVE-2026-19306 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories — by supplying absolute pat...

CVE-2026-19306

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain authenticated path traversal vulnerabilities (CWE-22) in three components: ChatInput (files parameter in build requests uses pathlib join that resets on absolute segments), JigsawStack File Upload (resolves FileInput paths without the access ...

CVE-2026-19306 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories — by supplying absolute pat...

Security Bulletin: Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

Summary Langflow contains multiple authenticated path-traversal vulnerabilities that allow an attacker to read arbitrary files accessible to the Langflow server process, bypassing the LANGFLOWRESTRICTLOCALFILEACCESS=true security control. The ChatInput component's files parameter accepts absolute...