CVE-2026-19303

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a path traversal flaw (CWE-22) in which a pathname used by a delete operation is not properly limited to a restricted directory. A remote attacker holding valid authenticated access (low privileges) to a Langflow instance can submit a crafted path and cause the application to delete arbitrary local files or directories outside the intended location. The attack does not expose data (no confidentiality impact) but can destroy application data, configuration, or system files, yielding loss of integrity and potential denial of service, consistent with the 8.1 (high) CVSS score with high integrity and availability impact. Anyone running an affected 1.x release is affected, with the greatest risk in network-reachable deployments where non-administrator accounts can log in, since authentication is required to trigger the flaw. No exploitation is currently known: there is no public proof of concept, the issue is not in CISA KEV, and EPSS estimates the 30-day exploitation probability at roughly 0.4% (32nd percentile).

What to do: Inventory all Langflow installations — including pip installs, Docker images, and bundled deployments — and upgrade to a fixed release later than 1.11.2 as specified in IBM's advisory. Until patched, restrict network exposure of Langflow, limit which authenticated accounts can reach the affected functionality, and run the Langflow process under a least-privilege filesystem account so stray deletions cannot hit critical system or application files. With no public PoC or in-the-wild exploitation known, patching on a normal maintenance cycle is reasonable rather than emergency response.