CVE-2026-7667

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0

Description An authenticated attacker can create a malicious flow that points to a URL under their control. By returning a specially crafted Content-Disposition header, such as filename="../../../target/path", the attacker can perform arbitrary file write operations. This allows the placement of attacker-controlled content into any path accessible by the Langflow process.

Recommendations Update IBM Langflow OSS to a version later than 1.10.0.