{"data":{"id":"3f65faa7-36c7-43f5-9472-4d2317e2177f","title":"CVE-2026-42048: Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable…","summary":"CVE-2026-42048 affects Langflow versions prior to 1.9.0 in the Knowledge Bases API (DELETE /api/v1/knowledge_bases). User-supplied knowledge base names are concatenated directly into file paths without sanitization or boundary validation. An authenticated attacker can delete arbitrary directories on the server's filesystem, causing data loss and potential service disruption.","solution":"Fixed in 1.9.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42048","publishedAt":"2026-05-12T18:17:23.780Z","cveId":"CVE-2026-42048","cweIds":["CWE-22"],"cvssScore":"9.6","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow@<= 1.8.4 (fixed: 1.9.0)"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow path traversal in Knowledge Bases API DELETE endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.04195,"epssCheckedAt":"2026-11-07T18:08:34.094Z","kevDateAdded":null,"advisoryAliases":["GHSA-9whx-c884-c68q"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:25.522Z","patchAvailable":true,"disclosureDate":"2026-05-12T18:17:23.780Z","fixReleasedAt":"2026-04-14T22:39:34.554Z","daysToFix":-28,"fixCheckedAt":"2026-10-29T21:36:29.801Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langflow","fixedVersion":"1.9.0","matchedVersion":"1.9.0","fixReleasedAt":"2026-04-14T22:39:34.554Z","daysToFix":-28,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:29.654Z"}]}}