PT-2025-52500 · Langflow · Langflow

J1Vvoo · CVE-2025-68478 · Published 2025-12-19 · Updated 2026-03-24

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.0

Description Langflow is a tool for building and deploying AI-powered agents and workflows. Before version 1.7.0, specifying an arbitrary path in the request body's fs path allows server-side file creation or overwriting at that specified path. There are no restrictions on the path, normalization, or allowed directories, meaning absolute paths, such as /etc/poc.txt, are interpreted as is. This could allow for arbitrary file manipulation.

Recommendations Update to version 1.7.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-73

CWE-610

Related Identifiers

CVE-2025-68478

GHSA-F43R-CC68-GPX4

PYSEC-2025-125

Affected Products

Langflow

References · 14

• 🔥 https://github.com/langflow-ai/langflow/security/advisories/GHSA-f43r-cc68-gpx4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68478.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-68478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68478 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-125 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f43r-cc68-gpx4 · Vendor Advisory
• https://github.com/langflow-ai/langflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2025-125.yaml · Note
• https://twitter.com/CVEnew/status/2002099129250726232 · Twitter Post
• https://t.me/CVEtracker/40280 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2002197204593770512 · Twitter Post
• https://twitter.com/CVEnew/status/2036505791059152951 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1pt1cm5/resumen_diario_de_vulnerabilidades_22122025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1pttxj6/resumen_diario_de_vulnerabilidades_23122025 · Reddit Post