Langflow CVE-2025-68478

Requires an authenticated session - a valid API Key or JWT accepted by the CurrentActiveUser dependency on POST /api/v1/flows - so this is not reachable by fully unauthenticated attackers. Given valid credentials, exploitation works against default configurations prior to the fixed version: the attacker simply supplies an attacker-chosen absolute fs_path in the request body (e.g., /etc/poc.txt), with no path restriction, normalization, or allowed-directory enforcement and no user interaction. The primary limiting factors are the authentication requirement, the OS-level file permissions of the Langflow service account (which bound which paths can actually be written/overwritten), and running a version at or above the patched release.

This is a genuine but conditional integrity-focused issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw, but PR:L is decisive: the vulnerable create_flow endpoint is gated behind CurrentActiveUser (API Key or JWT), so an attacker must already hold valid authenticated access. Impact is I:H with A:L and C:N, consistent with arbitrary file creation/overwrite (CWE-73) rather than data theft. Publicly available exploit code exists (GitHub Security Advisory GHSA-f43r-cc68-gpx4), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or automated exploitation at this time - treat POC availability and active exploitation as distinct signals. The most important signal mismatch: the input Tag labels this 'Information Disclosure,' which contradicts the CVSS vector (C:N, I:H) and the described behavior (writing/overwriting files) - this is an integrity/arbitrary-file-write bug, not disclosure. Net: a real priority for any internet-exposed or multi-tenant Langflow instance because authenticated file overwrite of paths like /etc can plausibly escalate to code execution or denial of service, but single-user/trusted-network deployments face lower urgency given the authentication requirement.

An attacker who already holds a valid Langflow API key or JWT (e.g., a low-privileged tenant, a leaked token, or a malicious internal user) sends a POST /api/v1/flows request with fs_path set to an absolute path such as /etc/poc.txt or a cron/config path. The server calls _verify_fs_path, touches the file if absent, then serializes the Flow object to JSON and writes/overwrites it at that location with no normalization or allowed-directory check. Public exploit code for this flow exists in the referenced GitHub advisory.