CVE-2026-19306

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a path traversal flaw (CWE-22) in the Chat Input to Message attachment pipeline of authenticated build requests, where absolute paths or traversal sequences supplied in the files parameter are resolved without the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary that is enforced for other file-reading components. An authenticated attacker with network access and low privileges can therefore read arbitrary files from the server filesystem, including the Langflow secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories. Because the read file contents are embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, the attacker also gains silent exfiltration of confidential data off the server. Any deployment of the affected open-source versions is exposed, most significantly shared or multi-tenant instances where users who can submit build requests are not fully trusted. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known and EPSS is 0.4%, so defenders currently have a window to patch proactively.

What to do: Upgrade Langflow OSS to a fixed release newer than 1.11.2 as soon as practical. Note that setting LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true does not close this specific pipeline, so until you upgrade, restrict which accounts can authenticate and issue build requests, limit server egress to known model endpoints, and treat the secret_key, JWT signing keys, the application database, and uploaded files as potentially disclosed on affected versions. Review Langflow logs for build requests whose files parameter contains absolute paths or traversal sequences (for example, ../) from untrusted accounts.