Loading vulnerability…
Authenticated Path Traversal in IBM Langflow OSS
A path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.3 allows a remote authenticated attacker to overwrite arbitrary files. Improper restriction of pathnames to an intended directory permits file writes outside that directory. The affected function and endpoint are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises file integrity by allowing arbitrary files outside the intended restricted directory to be overwritten. Additional consequences, including code execution or service disruption, are not established.
If you can’t patch tonight, do this now.
No workarounds or mitigations are listed in the security bulletin.
Patch, then assume compromise.
Upgrade to Langflow OSS version 1.12.4. Back up the existing installation, review upgrade preparation instructions and release-specific configuration changes, install the fixed version, and test existing flows.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.