Langflow Oss
Approved changes feed: RSS · Atom
cpe:2.3:a:ibm:langflow_oss:1.11.2:*:*:*:*:*:*:*
part: a version: 1.11.2 update: *
| Vendor | Ibm (177c0602-9232-5933-8f2f-9d22f079d22d) |
|---|---|
| Product | Langflow Oss (76f13290-9e1a-5502-bd5b-80373b8c1904) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-19303 |
vulnerable | 2026-09-16 04:34:15.589013 |
Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components
HIGH (8.1)
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.
Published: 2026-09-04T16:04:06.047Z
Updated: 2026-09-10T21:00:34.955Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9138 |
vulnerable | 2026-09-16 04:33:02.282158 |
Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components
MEDIUM (6.5)
IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when handling requests to the /api/v1/run/{flow_id} endpoint. An attacker with low‑privileged authenticated access (such as a valid API key or user session) can supply crafted path values, including absolute paths or path traversal sequences, allowing arbitrary file writes to locations writable by the Langflow process. Successful exploitation may lead to unauthorized file creation or modification, potentially resulting in further compromise depending on the deployment environment.
Published: 2026-09-04T14:27:27.568Z
Updated: 2026-09-10T21:00:35.612Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12766 |
vulnerable | 2026-09-16 04:32:51.384335 |
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
MEDIUM (5.4)
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Published: 2026-09-14T20:29:39.316Z
Updated: 2026-09-15T17:31:48.171Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.