CVE-2026-19306: Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components
IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOWRESTRICTLOCALFILEACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.
Other sources
Langflow OSS allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOWRESTRICTLOCALFILEACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.3 - Configuration
Ensure LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true is enforced to contain local file access (noting the boundary was bypassed for the Chat Input to Message attachment pipeline).
Langflow LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS = true
Event History
Frequently Asked Questions
Who is exposed to this issue?
IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected. Exploitation requires an authenticated attacker capable of submitting an authenticated build request.
Does enabling LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS prevent exploitation?
No. The issue bypasses LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true because the restriction was not enforced in the Chat Input to Message attachment pipeline.
What can an attacker access if exploitation succeeds?
An attacker can read arbitrary server-local files by supplying absolute paths or traversal sequences in the files parameter. The disclosed data can include secret keys, JWT signing keys, the application database, process environment data, and other tenants' upload directories.
How is data exfiltrated through this vulnerability?
Read file contents are embedded as text attachments in the language model prompt and sent to the configured model endpoint. This can expose server data to that endpoint in addition to the authenticated attacker.