IBM Langflow OSS EUVD-2026-113128

Exploitation requires a valid low-privilege authenticated session on the Langflow instance (CVSS PR:L), so it is not unauthenticated - an attacker must first obtain or be granted an account, which is the primary limiting factor. The affected feature is a pathname handler that improperly limits input to a restricted directory (CWE-22); the specific endpoint, parameter, or file-serving feature that accepts the traversal sequence is not described in the available sources. No user interaction is needed (UI:N) and the vector is network (AV:N), so any network-reachable deployment of IBM Langflow OSS 1.0.0 through 1.12.4 with a usable low-privilege account is exposed; instances restricted to trusted internal networks or without low-privilege account provisioning are correspondingly harder to reach. The description does not tie the flaw to a non-default configuration or specific deployment mode.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-level authentication and no user interaction, scoring 8.8 largely because the input claims full C:H/I:H/A:H impact. However, the description characterizes the outcome narrowly as a remote authenticated attacker obtaining sensitive information via path traversal (CWE-22), which supports a confidentiality impact but does NOT substantiate the High integrity and availability impacts asserted in the supplied vector - this is a notable internal conflict between the description and the scored impacts. No EPSS probability was provided, the vulnerability is not on CISA KEV, and no proof-of-concept or exploit reference appears in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is this_week rather than act_now or emergency, consistent with a patched, authenticated, information-disclosure issue in a developer-facing product rather than a mass-exploited internet emergency. Net: a genuine priority for any exposed Langflow instance because authentication is only PR:L and a patch exists, but likely a this_week remediation rather than a drop-everything event, and the headline 8.8 overstates impact relative to the information-disclosure behavior the description actually documents.

An attacker who holds a low-privilege authenticated account on an internet-reachable IBM Langflow OSS instance (1.0.0-1.12.4) sends a crafted request whose pathname component escapes the intended restricted directory, causing the application to read and return files outside that directory. This lets the attacker retrieve sensitive files - potentially configuration, credentials, or flow data stored on the host. No public PoC or exploit code was provided in the available data.