IBM Langflow OSS CVE-2026-104309

Exploitation requires valid authentication to the Langflow OSS instance (CVSS PR:L - a low-privilege account suffices, but anonymous/unauthenticated access is not indicated), and the instance must run an affected version (1.0.0 through 1.12.3). No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). The specific feature, endpoint, or configuration that exposes the path-traversal is not described in the available sources, so the precise request needed to trigger it cannot be stated from this data. The principal limiting factor is the authentication requirement: an attacker must first obtain or be granted a Langflow account, which constrains this to insiders, credentialed users, or attackers who have already achieved an initial foothold or credential compromise.

This is a moderate-severity, moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity path traversal that requires low-privilege authentication (PR:L) and yields high confidentiality impact with no integrity or availability effect - consistent with an authenticated user reading files outside the intended directory. There is no CISA KEV listing, no EPSS score supplied, and no public exploit or PoC reference in the input, so all three real-world exploitation signals point to no confirmed or probable active exploitation at this time. The vendor (IBM) both reported and patched the flaw, and the vuln.today decision label is 'this_month' - an elevated-but-not-urgent cadence that aligns with a confidentiality-only bug gated behind authentication. The main caveat: the description states only 'improper limitation of a pathname to a restricted directory' without naming the vulnerable endpoint or parameter, so the exact trigger is not described in the available sources; the C:H rating (full file-read confidentiality impact) is the vendor/NVD assessment and is plausible for arbitrary file read but is not corroborated by a detailed technical writeup here.

An attacker who already holds valid low-privilege credentials to a Langflow OSS instance (version 1.0.0-1.12.3) sends a crafted request containing directory-traversal sequences to a file-handling endpoint, causing the application to return files outside the intended restricted directory - potentially configuration files, secrets, or other sensitive data. No user interaction is required and the attack is performed remotely over the network. No public exploit or PoC was identified in the available sources, and the specific vulnerable endpoint is not described.