{"data":{"id":"3a4fde34-6ed0-4079-a413-487a7763c5d7","title":"CVE-2026-19303: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or dir","summary":"IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.2 has a vulnerability where an authenticated attacker (someone with valid login credentials) can delete any files or folders on the server because the software doesn't properly restrict which directories users can access. This happens because the application fails to limit file paths (the addresses of files on disk) to only safe, intended locations.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19303","publishedAt":"2026-09-04T16:17:24.077Z","cveId":"CVE-2026-19303","cweIds":["CWE-22"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["IBM Langflow"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-09-04T16:17:24.077Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}