CVE-2026-5027: Langflow - Path Traversal Arbitrary File Write via upload_user_file
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5027?
CVE-2026-5027 is categorized as a high-severity vulnerability due to its potential for arbitrary file write exploitation.
How do I fix CVE-2026-5027?
To fix CVE-2026-5027, ensure that the 'filename' parameter is properly sanitized to prevent path traversal attacks.
What kind of attack does CVE-2026-5027 allow?
CVE-2026-5027 allows an attacker to conduct path traversal attacks that enable arbitrary file writes on the server's filesystem.
Which endpoint is affected by CVE-2026-5027?
The vulnerability CVE-2026-5027 affects the 'POST /api/v2/files' endpoint.
What software is affected by CVE-2026-5027?
CVE-2026-5027 affects the Langflow software, particularly through its file upload feature.