PT-2026-28741 · Unknown · Api/V2/Files

Published 2026-03-27 · Updated 2026-04-12 · CVE-2026-5027

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Langflow versions (affected versions not specified)

Description The 'POST /api/v2/files' endpoint is susceptible to a path traversal issue due to insufficient sanitization of the filename parameter received through multipart form data. This allows attackers to write files to arbitrary locations on the filesystem by utilizing path traversal sequences such as '../'. Successful exploitation could lead to remote code execution in certain deployments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-5027

Affected Products

Api/V2/Files

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-5027 · Security Note
• https://tenable.com/security/research/tra-2026-26 · Note
• https://twitter.com/DarkWebInformer/status/2043477044248383608 · Twitter Post
• https://twitter.com/TheHackerWire/status/2037681009760878662 · Twitter Post
• https://twitter.com/NullSecurityX/status/2040049519606297016 · Twitter Post
• https://twitter.com/0xBlackash/status/2040115387287601221 · Twitter Post
• https://twitter.com/EQSTLab/status/2040041107074261134 · Twitter Post
• https://twitter.com/DarkWebInformer/status/2039820522565845052 · Twitter Post
• https://twitter.com/CveFindCom/status/2037555993027006604 · Twitter Post
• https://twitter.com/piedpiper1616/status/2040077941103792261 · Twitter Post