Arbitrary File Write via Malicious Flow in IBM Langflow OSS

Executive Summary

CVE-2026-7667 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. An authenticated attacker can create a malicious flow that points to an attacker-controlled URL. When the flow executes and saves a file from the URL, the Content-Disposition header can be manipulated to write arbitrary files to any accessible path on the system.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file writes in logs or unexpected file modifications in directories accessible by Langflow. Inspect API Request component configurations for flows with save_to_file=True pointing to external URLs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to write malicious files to any location accessible by the Langflow process. This could lead to remote code execution by overwriting critical files like shell configurations, SSH keys, or Python files. An attacker could gain control over the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Langflow OSS to version 1.10.1 or later immediately. Review and remove any suspicious flows or configurations that use the API Request component with save_to_file=True.

Useful 0 Not Useful 0