PT-2026-50141 · Langflow · Langflow
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Langflow versions prior to 1.9.0
Description
Langflow contains a path traversal flaw in the Knowledge Bases API endpoint 'POST /api/v1/knowledge bases'. The issue resides in the
create knowledge base() function, where the name variable is used to construct file paths without proper sanitization or containment checks. An authenticated attacker can provide traversal sequences or absolute paths in the name field to force the application to create directories and write files, specifically embedding metadata.json and schema.json, at any reachable location on the server's filesystem where the application has write permissions. This can lead to cross-user data compromise, arbitrary filesystem manipulation, and the corruption of existing knowledge bases through data overwrite.Recommendations
Update to version 1.9.0.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Langflow