EUVD-2026-45331
GHSA-8f66-77fw-hmvj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable component abusable by any authenticated low-privilege user (PR:L) with no interaction; high confidentiality and integrity from cross-user read/overwrite, no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents, appends attacker-controlled data, and uploads a copy containing victim data to the attacker's namespace (confidentiality breach). In overwrite mode, the attacker can replace victim file contents with arbitrary data (integrity breach). This breaks the storage ownership boundary between users.
AnalysisAI
Cross-user file access in IBM Langflow OSS (1.0.0 through 1.10.1) lets an authenticated user abuse the SaveToFile component to read and modify files uploaded by other users by supplying absolute paths that point into victim storage locations. Append mode enables exfiltration of victim data into the attacker's namespace (confidentiality), while overwrite mode allows replacing victim content with arbitrary data (integrity), collapsing the per-user storage ownership boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid low-privilege Langflow OSS account (CVSS PR:L, authenticated) on a running 1.0.0-1.10.1 instance and be able to create or run a workflow that uses the SaveToFile component with an attacker-specified absolute path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N = 8.1 High) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication and no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with an authenticated multi-tenant data-boundary break. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privilege but authenticated Langflow user builds a workflow whose SaveToFile component targets an absolute path belonging to another user's storage. In append mode the workflow reads the victim's file, appends attacker data, and writes the combined content - now containing the victim's data - into the attacker's own namespace for retrieval; in overwrite mode the same access is used to clobber the victim's file with arbitrary content. … |
| Remediation | Patch available per vendor advisory - upgrade to the fixed release identified in IBM's advisory at https://www.ibm.com/support/pages/node/7279990 (the input does not include an exact fixed version string, so confirm the target version directly from that advisory before deploying). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM Langflow OSS deployments and inventory current versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Langflow Oss
View allUnauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-l
Insecure deserialization (CWE-502) in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any party with access to the b
Arbitrary code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows remote attackers to run code on the ho
Authorization bypass in IBM Langflow OSS 1.0.0 through 1.8.4 allows unauthenticated remote attackers to access protected
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today