What is the CVSS score of CVE-2026-7667?

CVE-2026-7667 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow are affected by CVE-2026-7667?

IBM Langflow OSS versions 1.0.0-1.10.0 allow authenticated users to write arbitrary files to the server, enabling full compromise through code injection, credential theft, and configuration…. A patch is available.

How to fix or mitigate CVE-2026-7667?

Within 24 hours: inventory all deployments of Langflow 1.0.0-1.10.0, verify vendor-patch availability, and identify patching windows aligned with operational schedules. Within 7 days: test the patch in a staging environment and deploy to all production systems. Within 30 days: verify patch deployment across all systems and audit access logs from the preceding 90 days for evidence of exploitation, including unusual file writes or flow creation.

IBM Langflow CVE-2026-7667

EUVD-2026-45288 HIGH

Path Traversal (CWE-22)

2026-07-17 ibm

GHSA-p7fv-5pcm-4rh4

Path Traversal IBM Langflow Oss

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable flow creation needs an authenticated low-priv user (PR:L), no interaction (UI:N); arbitrary file write enables code execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:50 vuln.today

CVE Published

Jul 17, 2026 - 19:21 cve.org

HIGH 8.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary file write operations with attacker-controlled content to any path accessible by the Langflow process.

AnalysisAI

Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user create a malicious flow that points to an attacker-controlled URL returning a crafted Content-Disposition header, causing the Langflow process to write attacker-supplied content to any filesystem path it can access. Because writes can land on startup scripts, keys, or configuration files, this path-traversal (CWE-22) flaw is a realistic route to full server compromise. IBM has released a fix; no public exploit identified at time of analysis and the CVE is not in CISA KEV.

Technical ContextAI

Langflow is a Python-based, low-code visual builder for LLM/agent applications where users assemble 'flows' from components, some of which fetch remote resources. This vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): when a flow component downloads a file, Langflow derives the local filename from the server-supplied Content-Disposition header (e.g. filename="../../../target/path") without sanitizing traversal sequences, so a remote server the attacker controls dictates where the response body is saved. The affected package per CPE is cpe:2.3:a:ibm:langflow_oss (all listed versions in the 1.0.0-1.10.0 range). The trust boundary failure is treating an HTTP response header from an arbitrary URL as a safe destination path rather than a hostile input.

RemediationAI

Patch available per vendor advisory - upgrade to the fixed IBM Langflow OSS release identified in the IBM Security Bulletin at https://www.ibm.com/support/pages/node/7278931 (consult that advisory for the exact patched version, which is not enumerated in the input data). Until patched, reduce exposure by restricting who can authenticate and create flows: disable open/self-service registration, enforce strong authentication and least-privilege user roles, and place the Langflow instance behind a VPN or network ACL rather than on the public internet. As a compensating control, use egress filtering to restrict outbound HTTP requests from the Langflow process to only trusted hosts, which blocks the attacker-controlled-URL step (trade-off: breaks flows that legitimately fetch external resources); additionally run the Langflow process as a low-privilege, sandboxed/containerized user with a read-only root filesystem so an arbitrary write cannot reach sensitive paths (trade-off: requires writable volumes for legitimate output directories).