Path traversal in Langflow OSS File component tar extraction (CVE-2026-7872)

A path traversal vulnerability in the Langflow OSS File component's tar archive extraction functionality allows an authenticated attacker to upload a specially crafted tar archive containing symbolic links to read arbitrary files accessible to the application process. The flaw occurs because path validation logic performs lexical resolution on symbolic link members before they are written to disk, allowing validation to pass while extraction creates symbolic links pointing outside the intended directory. This can be exploited to extract the JWT signing key and forge authentication tokens for any user, including administrative users. Affected versions: - 1.0.0-1.10.0 We recommend updating to: 1.10.1. CVSS 7.5 · our assessment: this_week Vendor advisory: https://www.ibm.com/support/pages/node/7278934 Details: https://vuln.today/cve/CVE-2026-7872