What is the CVSS score of CVE-2026-7869?

CVE-2026-7869 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-7869?

Yes, a patch is available for CVE-2026-7869. Update the affected software to the latest version immediately.

IBM Langflow OSS CVE-2026-7869

EUVD-2026-53550 MEDIUM

Path Traversal (CWE-22)

2026-08-05 ibm

GHSA-7xr9-m7x2-5wqq

Path Traversal IBM Langflow Oss

5.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Arbitrary write to any filesystem path warrants I:H; description confirms no read/confidentiality impact, so C:N; PR:L per authenticated requirement.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 18:49 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.

AnalysisAI

Arbitrary file write via path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to create directories and write files to arbitrary locations on the server filesystem through the Knowledge Bases API. The flaw stems from unsanitized user-supplied knowledge base names being passed directly into file path construction, making exploitation straightforward once credentials are obtained. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.

Technical ContextAI

IBM Langflow OSS is IBM's distribution of the open-source Langflow AI workflow platform, which provides REST APIs for managing AI pipelines, knowledge bases, and related resources. The vulnerable endpoint is POST /api/v1/knowledge_bases, where the user-supplied knowledge base name field is concatenated into a server-side filesystem path without applying path normalization, prefix-confinement (e.g., ensuring the resolved path remains under a designated base directory), or character-class filtering. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal') flaw: by embedding sequences such as '../../../' in the name parameter, an attacker can escape the intended storage root. The CPE string cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* covers all versions from 1.0.0 through 1.10.3 of the IBM-packaged product. The impact is an arbitrary write primitive - the server will create any directory tree and place attacker-controlled file content at any path the process user can reach.

RemediationAI

The primary remediation is to apply the vendor-released patch documented in the IBM security advisory at https://www.ibm.com/support/pages/node/7282647; the exact fixed version should be confirmed from that advisory, as the input data confirms patch availability but does not specify the patched release number. Until patching is possible, restrict access to the Knowledge Bases API endpoint (POST /api/v1/knowledge_bases) at the network or reverse-proxy layer to trusted, known-good user accounts or IP ranges only - note this reduces functionality for legitimate users. Additionally, run the Langflow OSS service under a dedicated low-privilege OS account with filesystem permissions restricted to only the directories required for normal operation (e.g., using chroot, a container with a read-only root filesystem and explicit volume mounts, or OS-level DAC/MAC controls such as AppArmor or SELinux confinement), which limits the blast radius of the write primitive even if exploited. Monitor for anomalous file creation outside expected application directories as a compensating detection control.