Shawn Dong

**Name of the Vulnerable Software and Affected Versions** IBM Langflow OSS versions 1.0.0 through 1.10.0 **Description** Improper input validation in the `APIRequest` component allows an attacker to write arbitrary files to unintended locations. This occurs when the Save to File feature is enabled, as filenames extracted from HTTP response Content-Disposition headers are not sanitized before being joined to the temporary directory path. An attacker controlling an external HTTP server can provide crafted filename values containing path traversal sequences (e.g., `../`), which are sequences of characters used to access files and directories outside the current working directory, enabling arbitrary file writes to locations accessible by the Langflow process. **Recommendations** Update IBM Langflow OSS to a version later than 1.10.0. Disable the Save to File feature in the `APIRequest` component as a temporary mitigation measure.