Critical Path Traversal Flaw Found in IBM Langflow OSS

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical path traversal vulnerability, identified as CVE-2026-8859, which carries a CVSS score of 9.9. This flaw permits an attacker to write arbitrary files to unintended locations on the host system by exploiting improper input validation within the APIRequest component.

What's at Risk

The vulnerability affects all deployments of IBM Langflow OSS ranging from version 1.0.0 to 1.10.0. Organizations that have enabled the "Save to File" feature in the APIRequest component are at the highest level of risk.

Systems that are internet-facing or have the ability to interact with external, untrusted HTTP servers are particularly exposed. Because this flaw allows for arbitrary file writes, any environment where the Langflow process runs with elevated privileges could be compromised, potentially leading to full system takeover.

How the Flaw Works

This vulnerability is a form of path traversal, a common class of security weakness that occurs when an application uses user-supplied input to construct a file path without sufficient sanitization. In general, this allows an attacker to break out of the intended directory structure by using sequences like "../" to navigate to sensitive areas of the file system.

When an application fails to validate these inputs, it may inadvertently grant an attacker the ability to overwrite critical configuration files, upload malicious scripts into executable directories, or modify system binaries. In many scenarios, this type of flaw is leveraged by attackers to gain remote code execution, as they can place malicious payloads exactly where the operating system or application will automatically execute them.

How to Protect Your Systems

• Identify all instances of IBM Langflow OSS version 1.0.0 through 1.10.0 within your environment and prepare for an immediate update.
• Disable the "Save to File" feature in the APIRequest component until a patched version is deployed to mitigate the primary attack vector.
• Restrict network access to the Langflow instance, ensuring it cannot communicate with arbitrary or untrusted external HTTP servers.
• Monitor system logs for unusual file write activity or attempts to access directories outside of the designated application workspace.
• Follow established vendor hardening guides to ensure the application runs with the principle of least privilege, minimizing the impact if a component is compromised.

Given the critical severity of CVE-2026-8859 and the potential for arbitrary file writes, organizations must treat this as a high-priority remediation task. Promptly addressing this flaw is essential to preventing unauthorized system modification and maintaining the integrity of the underlying infrastructure.