CVE-2026-110190: Langflow OSS is affected by multiple vulnerabilities
Published Oct 19, 2026
·Updated
IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.
Other sources
Langflow OSS could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.
— IBM
Affected Software
2 affected components
IBM Langflow OSS<=1.0.0 - 1.12.4
Langflow Langflow>=1.0.0<1.12.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.5
Event History
Oct 19, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Oct 29, 2026
CVE Published
via MITRE·03:15 PM
Data Sourced
via MITRE·03:15 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
RemedyAffected Software
Data Sourced
via OSV·04:17 PM
DescriptionSeverity
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authenticated to Langflow OSS and able to send a specially crafted URL request.
2
What access could a successful attacker gain?
A successful exploit could allow the attacker to traverse directories and view arbitrary files on the underlying system.