CVE-2026-42867: Langflow Path Traversal in Knowledge Bases API

Technical summary

CVE-2026-42867 is a path traversal vulnerability (CWE-22) affecting Langflow versions prior to 1.9.0. The vulnerable endpoint is POST /api/v1/knowledge_bases, which accepts a knowledge base name parameter without sufficient sanitization. The application directly incorporates this user-supplied input into file system paths without canonicalization or containment checks. An authenticated attacker can bypass directory restrictions using path traversal sequences (e.g., '../') to write files outside the intended knowledge base directory tree, achieving arbitrary file write capabilities on the host system.

Business impact

While exploitation requires valid authentication credentials, the ability to write arbitrary files on a Langflow server poses significant operational risk. An attacker could inject malicious files into application directories, modify configuration files, corrupt data stores, or stage further compromise. For organizations deploying Langflow in production environments with AI agent automation, unauthorized file writes could disrupt service availability, compromise the integrity of AI workflows, or enable lateral movement within the infrastructure.

Affected systems

Langflow versions prior to 1.9.0 are affected. The vulnerability resides in the Knowledge Bases API endpoint. Any deployment running an unpatched version with network exposure to the /api/v1/knowledge_bases endpoint is at risk if authenticated users can be compromised or if internal users have malicious intent.

Exploitability

Exploitation requires valid authentication to access the API endpoint. The attack complexity is low, and no user interaction is required. While the barrier to entry (authentication) is present, once an attacker has credentials—through credential compromise, insider threat, or weak credential hygiene—the vulnerability is trivial to exploit via direct API requests. The likelihood of authenticated user compromise in many environments makes this practically exploitable despite the authentication requirement.

Remediation

Upgrade Langflow to version 1.9.0 or later, which includes proper input sanitization and path containment mechanisms. Before upgrading, restrict network access to the Langflow API to trusted internal networks and implement strict authentication controls. Review knowledge base management logs to identify any suspicious activity or unexpected file creation in recent deployments.

Patch guidance

Deploy Langflow 1.9.0 or newer. Verify the patch by checking the application version in the Langflow dashboard or via version endpoints. Test the upgrade in a staging environment to ensure compatibility with custom workflows and knowledge bases. If immediate patching is not possible, disable or restrict access to the Knowledge Bases API at the network or API gateway level.

Detection guidance

Monitor for POST requests to /api/v1/knowledge_bases with knowledge base names containing path traversal sequences ('../', '..\', encoded variants). Alert on file creation or modification in directories outside expected knowledge base storage paths. Review authentication logs for unusual API access patterns or credential usage. Examine file system logs for unexpected write operations correlating with API activity timestamps.

Why prioritize this

While rated MEDIUM severity (CVSS 6.5) due to the authentication requirement, this vulnerability should be prioritized for remediation because it enables direct server compromise through file write capabilities. Authentication is often a weaker barrier than assumed—credential leaks, insider threats, and API token exposure are common. The ease of exploitation once authenticated access is obtained warrants prompt patching.

Risk score, explained

CVSS 3.1 score of 6.5 reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege elevation needed (PR:N), no user interaction required (UI:N), and impacts to integrity and availability (I:L/A:L) without confidentiality impact. The score appropriately penalizes the requirement for authentication (PR:N scope) but does not fully capture organizational risk in environments with weak credential management, making contextualized assessment important.

Frequently asked questions