CVE-2026-9225: Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/{flowid} endpoint, the application allows component inputs to reference storage paths using arbitrary user or flow identifiers without verifying ownership. An attacker with low‑privileged authenticated access can supply a crafted file path pointing to another user’s storage namespace, causing the backend to read and return the contents of files uploaded by other users. This vulnerability bypasses intended authorization checks enforced by the file management API and may result in unauthorized disclosure of sensitive user data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated access to Langflow, but only low-privileged access is required. The issue affects deployments where the attacker can execute a flow through the /api/v1/run/advanced/{flow_id} endpoint and use the File or Read File component.
What does an attacker need to do to access another user's files?
The attacker supplies a crafted storage path containing another user's or flow's identifier as a component input. The backend does not verify that the referenced storage namespace belongs to the requesting user before reading and returning the file contents.
What is the impact?
The issue can disclose sensitive files uploaded by other Langflow users. The provided information describes confidentiality impact; it does not describe modification or deletion of files.
How can defenders identify potentially affected systems?
IBM Langflow OSS versions 1.0.0 through 1.11.5 are identified as affected. Review use of the advanced flow execution endpoint and File/Read File component inputs for storage paths that reference user or flow identifiers not owned by the authenticated requester.