IBM Langflow OSS CVE-2026-110190

Exploitation requires a valid authenticated session to IBM Langflow OSS (CVSS PR:L), after which the attacker sends a specially crafted URL request with directory-traversal input to read arbitrary files on the host; no user interaction is needed (UI:N) and it is reachable over the network (AV:N). Limiting factors: only versions 1.0.0 through 1.12.4 are affected, authentication is mandatory so purely anonymous exploitation is not indicated by the CVSS vector, and impact is read-only (C:H, I:N, A:N) - it exposes file contents but does not grant write or code execution. The specific endpoint, feature, or configuration that exposes the traversal is not described in the available sources.

This is a moderate-severity path traversal (CWE-22) in IBM Langflow OSS with a CVSS 3.1 base score of 6.5 and vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The signals are internally consistent rather than conflicting: network-reachable (AV:N) and low attack complexity (AC:L), but it requires an authenticated user (PR:L), and impact is confined to confidentiality (C:H, I:N, A:N) - it enables reading arbitrary files, not modifying them or disrupting service. There is no CISA KEV listing, no EPSS score, and no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. The vuln.today Decision label is 'this_month', which aligns with a real-but-not-emergency priority: a credentialed attacker (or a compromised/low-privileged account) can read sensitive files such as configuration, secrets, or environment data, but the authentication requirement and confidentiality-only impact keep this below top-tier urgency. Treat it as a planned-patch item within the normal cycle, prioritizing instances exposed to untrusted or multi-tenant users. Note that EPSS and KEV data are absent from the input rather than confirmed negative; absence of an exploit signal is not proof one will not appear.

An authenticated Langflow user (or an attacker who has obtained any valid low-privilege credential) sends a specially crafted URL request containing directory-traversal sequences to a file-serving endpoint. Because attack complexity is low and the request is made over the network, the server returns the contents of arbitrary files outside the intended directory, exposing configuration, credentials, or other sensitive data. No public exploit identified at time of analysis.