CVE-2026-79725: Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
Published Sep 8, 2026
·Updated
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.
Other sources
Langflow OSS could allow a remote authenticated attacker to read arbitrary files due to improper access control.
— IBM
Affected Software
1 affected component
IBM Langflow OSS<=1.0.0-1.11.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.6
Event History
Sep 8, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 10, 2026
CVE Published
via MITRE·09:40 PM
Data Sourced
via MITRE·09:40 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require existing Langflow credentials?
Yes. The issue is described as requiring a remote authenticated attacker, so an attacker needs valid authentication to the affected Langflow OSS instance.
2
Is this limited to local access?
No. The vulnerability is described as remotely exploitable by an authenticated attacker.