CVE-2026-8859

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0

Description Improper input validation in the APIRequest component allows an attacker to write arbitrary files to unintended locations. This occurs when the Save to File feature is enabled, as filenames extracted from HTTP response Content-Disposition headers are not sanitized before being joined to the temporary directory path. An attacker controlling an external HTTP server can provide crafted filename values containing path traversal sequences (e.g., ../), which are sequences of characters used to access files and directories outside the current working directory, enabling arbitrary file writes to locations accessible by the Langflow process.

Recommendations Update IBM Langflow OSS to a version later than 1.10.0. Disable the Save to File feature in the APIRequest component as a temporary mitigation measure.