Langflow EUVD-2026-91119

Requires the attacker to reach the Langflow backend's knowledge-base creation route (HTTP POST to /api/v1/knowledge_bases, handler at knowledge_bases.py:51) and to supply an attacker-controlled absolute path/filename, which the handler writes to host storage without boundary enforcement. No special non-default feature toggle is named in the description. Limiting factors: the Langflow API must be network-reachable, and although CVSS rates this PR:N, Langflow installations that enforce API login would require valid authentication, so the practical prerequisite in many environments is an authenticated session plus an exposed backend; the overall impact (overwrite of files at a chosen absolute path) is bounded by the OS privileges of the Langflow process.

Signals are moderate and largely consistent. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 7.5) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, with high integrity impact and no confidentiality/availability impact - consistent with arbitrary file write via absolute-path traversal. EPSS is low (0.23%, 13th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. A referenced public gist (Ro1ME) appears to be a proof-of-concept/write-up, so publicly available exploit code likely exists, but POC availability is a distinct signal from active exploitation and does not elevate this to in-the-wild status. CONFLICT TO VERIFY: CVSS asserts PR:N (unauthenticated), but Langflow normally ships with authentication on its API, so real-world exploitation may require authenticated access (PR:L) depending on deployment - treat the unauthenticated rating as the description-provided value, not an independently confirmed fact. No SSVC decision data was provided. Net: this is a real but second-tier priority - genuine arbitrary-file-write primitive that can escalate to code execution via overwritten config/code, tempered by low EPSS, no KEV, and likely authentication/exposure prerequisites in many deployments.

An attacker with network access to an exposed Langflow backend sends an HTTP POST to the knowledge-base creation endpoint supplying an absolute path (e.g. a system config or startup script location) as the target. Because the handler forwards the attacker-controlled path into file creation without boundary enforcement, a file is written or overwritten outside the intended workspace, which can corrupt configuration or plant executable content leading to code execution. A public gist proof-of-concept is referenced, lowering the barrier to weaponization.