{"data":{"id":"a004f117-fea9-45b5-b86c-4d2b32f71fba","title":"CVE-2026-13445: IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read…","summary":"IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a flaw in the SaveToFile component. An authenticated attacker can supply absolute paths to victim storage locations, reading and modifying other users' uploaded files and breaking the storage ownership boundary between users. In append mode the attacker can read victim contents and copy them into their own namespace, and in overwrite mode they can replace victim file contents.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13445","publishedAt":"2026-07-17T21:17:05.473Z","cveId":"CVE-2026-13445","cweIds":["CWE-639"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS SaveToFile allows reading and modifying other users' files","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0035,"epssCheckedAt":"2026-11-12T15:03:08.463Z","kevDateAdded":null,"advisoryAliases":["GHSA-8f66-77fw-hmvj"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T18:09:58.774Z","patchAvailable":null,"disclosureDate":"2026-07-17T21:17:05.473Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}