CVE-2026-7524 Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction...

PT-2026-43984

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.9.1 Description Improper validation of symbolic links during archive extraction could allow remote code execution. This occurs when the software fails to correctly verify symbolic links shortcuts that...

CVE-2026-7524: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction...

IBM Langflow 路径遍历漏洞

IBM Langflow is a visual process orchestration tool developed by IBM Corporation. Versions 1.0.0 to 1.9.1 of IBM Langflow contain a path traversal vulnerability. This vulnerability arises from improper validation of symbolic links during archive extraction, which may lead to remote code execution...

CVE-2026-7528: Uncontrolled Resource Consumption

IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption...

PT-2026-43985

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.9.0 Description Uncontrolled resource consumption may lead to a denial of service, a condition where a system becomes unavailable to its intended users. Recommendations At the moment, there is no...

IBM Langflow 资源管理错误漏洞

IBM Langflow is a visual process orchestration tool developed by the American multinational company International Business Machines IBM. Versions 1.0.0 to 1.9.0 of IBM Langflow contain resource management vulnerabilities. These vulnerabilities stem from uncontrolled resource consumption, which ma...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Langflow

No d...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Langflow

No d...

Langflow Unauthenticated RCE (validate endpoint)

Langflow versions up to and including 1.7.3 contain a remote code execution vulnerability in the validate endpoint where unsanitized values in execglobals/code allow an attacker to execute arbitrary Python code. This module abuses the /api/v1/autologin or /api/v1/login and /api/v1/validate/code...

Exploit for Code Injection in Langflow

CVE-2026-33017 — Langflow Unauthenticated Remote Code Executio...

Exploit for Origin Validation Error in Langflow

CVE-2025-34291 — Langflow Origin Validation / CORS...

CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added two security flaws impacting Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerabilities in question are listed below -...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-34291link is external Langflow Origin Validation Error Vulnerability CVE-2026-34926link is external Trend Micro Apex One On-Premise Directory Traversal...

The vulnerability of the final point of the application software interface/api/v1/build_public_tmp/{flow_id}/flow, which is used for creating and deploying agents and processes in Langflow. This allows a perpetrator to execute arbitrary code.

The vulnerability of the endpoint of the application programming interface/api/v1/buildpublictmp/flowid/flow for creating and deploying Langflow agents and processes is related to the lack of authentication for the critical function. Exploiting this vulnerability allows a malicious actor to execu...

CVE-2026-42048

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API DELETE /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are concatenated directly into file paths withou...

Exploit for Cross-site Scripting in B3Log Siyuan

CVE-2026-33017 — Langflow Unauthenticated RCE Nuclei Template...

CVE-2026-42048

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API DELETE /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are concatenated directly into file paths withou...

CVE-2026-42048 Langflow: Path Traversal in Langflow Knowledge Bases API

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API DELETE /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are concatenated directly into file paths withou...

CVE-2026-42048 Langflow: Path Traversal in Langflow Knowledge Bases API

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API DELETE /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are concatenated directly into file paths withou...