CVE-2026-77819: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.
Other sources
Langflow OSS could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading, then test your flows after installing version 1.12.4.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker must be remotely authenticated to exploit the arbitrary file overwrite vulnerability. No user interaction is required.
How can I determine whether my deployment is affected?
Check the installed IBM Langflow OSS version. Versions 1.0.0 through 1.12.3 are identified as affected.