CVE-2026-17621: IBM Langflow OSS path traversal through crafted URL requests

Summary

IBM Langflow OSS versions 1.0.0 through 1.10.2 contain a directory traversal flaw tracked as CVE-2026-17621. A remote attacker can send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumFake OpenAI, SpaceX events used to steal Microsoft, Google accountsSimilar attack · BleepingComputer
• HighGHSA-64vx-6h2c-rjh7: Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCESimilar attack · GitHub Advisory Database
• MediumHacking on Autopilot: Inside ARTEX Cybercrime CampaignsSimilar attack · Check Point Research
• MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
• MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database