IBM Langflow OSS EUVD-2026-71217

Exploitation requires a valid Langflow user account or API key with at least low-privileged authenticated access-unauthenticated exploitation is not possible per PR:L in the CVSS vector. The flow being executed must include or be crafted to use the SaveToFileComponent, which is a standard built-in node, so no non-default plugin or configuration is required beyond the attacker's ability to define or modify a flow. The attack is limited by the OS-level write permissions of the Langflow process: if running under a restricted user with writes confined to a designated output directory, traversal to sensitive system paths will fail with a permission error. Exploitation is also limited to Langflow OSS versions 1.0.0-1.11.2; later patched versions are not affected per vendor advisory.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N accurately captures the principal risk: low attack complexity, network-accessible, but requiring authenticated low-privileged access (PR:L). The integrity impact is rated High because arbitrary file writes can overwrite application code, cron scripts, or configuration files depending on the deployment environment, potentially escalating to remote code execution as a secondary chain. Confidentiality is unaffected as a direct consequence-this is a write-only primitive. No EPSS data was provided and no CISA KEV listing is present, indicating no confirmed opportunistic or widespread exploitation at time of analysis; the CVSS score of 6.5 reflects the authentication barrier reducing practical risk compared to an unauthenticated path traversal. The lack of scope change (S:U) in the CVSS vector is reasonable for the direct impact, though in practice the post-exploitation severity depends heavily on the OS user running Langflow and whether writable locations include executable paths. Organizations running Langflow with broad filesystem permissions (e.g., running as root or with write access to web roots) face meaningfully higher effective risk than the base score suggests.

An attacker with a valid Langflow API key or user session constructs a flow containing a SaveToFileComponent and sets the output path parameter to a traversal string such as ../../../../etc/cron.d/malicious, then triggers execution via POST /api/v1/run/{flow_id}. If the Langflow process has write access to the target directory, the crafted cron entry is written to the system scheduler, enabling arbitrary command execution at the next scheduled interval. No public proof-of-concept code has been identified, but the primitive is straightforward for any authenticated user familiar with Langflow's API.