IBM Langflow CVE-2026-7667

Exploitation requires an authenticated Langflow account with the ability to create or edit flows (CVSS PR:L confirms authentication is needed). The attacker must control an external URL/web server that the flow can reach and have it return a crafted Content-Disposition header containing directory-traversal sequences in the filename parameter. What limits exploitation: the target path must be writable by the Langflow process (impact is bounded by that process's filesystem privileges); the Langflow instance must be able to make outbound requests to the attacker's server (blocked by egress filtering); and only versions 1.0.0 through 1.10.0 of IBM Langflow OSS are affected. No user interaction is required beyond the attacker's own actions (UI:N).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8, High) indicates a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high impact to confidentiality, integrity and availability - consistent with an authenticated user who can create flows escalating to arbitrary file write and likely code execution. The key limiting factor is PR:L: the attacker must already be an authenticated Langflow user, so real-world risk hinges on how exposed and multi-tenant a given deployment is; internet-facing instances with self-registration or weak auth are materially more at risk than isolated internal ones. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input and should be treated as unquantified rather than low. This is a genuine priority for exposed Langflow instances given the low complexity and RCE-grade impact, tempered only by the authentication requirement.

An attacker with a low-privileged Langflow account builds a flow whose component fetches a URL on a server they control; that server responds with a Content-Disposition header like filename="../../../../etc/cron.d/evil" and a malicious payload as the body. Langflow saves the body to that traversed path, letting the attacker overwrite a cron job, startup script, or config file and pivot to code execution as the Langflow process. The network attack vector and low complexity (AV:N/AC:L) make this straightforward once authenticated; no public POC was identified in the provided data.