Path traversal in the API Request component of IBM Langflow OSS (CVE-2026-7667)

CVE-2026-7667 is a path traversal vulnerability in the API Request component of IBM Langflow OSS affecting the Content-Disposition header processing logic. An authenticated attacker can create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header containing directory traversal sequences, enabling arbitrary file write operations to any path accessible by the Langflow process. Successful exploitation could lead to remote code execution by overwriting critical files such as shell configuration files, SSH authorized keys, or Python files within the application environment. Affected versions: - 1.0.0-1.10.0 We recommend updating to: 1.10.1. CVSS 8.8 · our assessment: this_week Vendor advisory: https://www.ibm.com/support/pages/node/7278931 Details: https://vuln.today/cve/CVE-2026-7667