CVE-2026-13445: IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read an

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a vulnerability where a logged-in attacker can misuse the SaveToFile component (a tool that saves data to files) to access and change files belonging to other users by using absolute paths (complete file addresses). The attacker can either read and copy other users' files to their own account (confidentiality breach, where private information is exposed) or overwrite those files with fake data (integrity breach, where data is corrupted or replaced).