IBM Langflow CVE-2026-13445

The attacker must hold a valid low-privilege Langflow OSS account (CVSS PR:L, authenticated) on a running 1.0.0-1.10.1 instance and be able to create or run a workflow that uses the SaveToFile component with an attacker-specified absolute path. Concretely, exploitation requires supplying an absolute filesystem path that points at another user's storage location, then using append mode to read+exfiltrate victim data or overwrite mode to tamper with it. What limits exploitation: it is not usable by unauthenticated outsiders, and it only yields cross-user impact on multi-user/shared deployments - a single-tenant or single-user instance has no victim namespace to violate, and the attacker must know or guess the victim's storage path.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N = 8.1 High) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication and no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with an authenticated multi-tenant data-boundary break. No EPSS score, SSVC decision, KEV entry, or POC was supplied, so real-world exploitation likelihood cannot be quantified from the input, and absence of these signals should not be read as low risk. Practical priority depends heavily on deployment: a shared/multi-user Langflow instance where distinct users must be isolated makes this a genuine high priority, whereas a single-user or single-tenant deployment materially reduces impact because there is no victim namespace to cross into. Because PR:L requires the attacker to already hold a valid (even low-privilege) account, this is more of an insider/foothold-escalation risk than an unauthenticated internet-wide threat.

A low-privilege but authenticated Langflow user builds a workflow whose SaveToFile component targets an absolute path belonging to another user's storage. In append mode the workflow reads the victim's file, appends attacker data, and writes the combined content - now containing the victim's data - into the attacker's own namespace for retrieval; in overwrite mode the same access is used to clobber the victim's file with arbitrary content. No public POC is identified, but the low attack complexity and lack of required user interaction make the technique straightforward for any account holder.