Critical Root Access and Arbitrary File Write Flaws Disclosed in Network-Exposed Systems
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 23, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers root access and another that enables arbitrary file write through path traversal. CVE-2026-3587 describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to CWE-912 and assigned a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with CERT VDE publishing advisory VDE-2026-020.
A separate vulnerability, CVE-2026-5027, affects Langflow's POST /api/v2/files endpoint, where improper sanitization of the multipart filename parameter allows path traversal using ../ sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as CWE-22, carries the CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and is referenced in Tenable advisory TRA-2026-26.
