IBM Langflow OSS CVE-2026-104312

The attacker must hold authenticated access to the Langflow OSS instance to drive the server into generating the malicious ZIP export (PR:L). The write only occurs on a victim's host, and only if that victim downloads the server-generated archive and extracts it with a non-sanitizing extraction tool (UI:R) - this is the key limiting factor, since current archive utilities and OS extractors generally sanitize traversal paths, so default/up-to-date extraction tooling defeats the attack. Affected deployments are IBM Langflow OSS 1.0.0 through 1.12.3; the Langflow server itself is not directly compromised.

This is a low-severity, low-priority issue and the signals are consistent in saying so. IBM's own CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N = 3.5) shows the critical constraints: exploitation requires an authenticated actor (PR:L) on the Langflow server to generate the malicious archive, and the actual damage only occurs if a victim (UI:R) later extracts that archive with a non-sanitizing extraction tool. The impact is limited to integrity (I:L) with no confidentiality or availability effect, and notably the harm lands on the victim's host, not the Langflow server itself. The vuln.today decision label is 'monitor', the lowest urgency tier, and there is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis - all pointing to no evidence of real-world exploitation. The chain of required conditions (attacker authentication + victim download + victim using an outdated/non-sanitizing unzip tool) makes practical exploitation unlikely, since most modern archive utilities and OS extractors already sanitize traversal paths. Note one mechanism detail: the trigger specifics (exactly how entry paths are crafted server-side) are not described in the available sources beyond the Zip-Slip-style path traversal (CWE-22) classification.

An authenticated Langflow OSS user triggers the server to generate a ZIP export whose entry paths contain directory-traversal sequences. The attacker distributes this archive to a victim, who downloads and extracts it using a non-sanitizing extraction tool, causing files to be written outside the intended directory onto the victim's host. No public exploit code was identified at time of analysis, and the attack is contingent on the victim's extraction tool failing to sanitize paths.