Langflow Path Traversal via Content-Disposition Header Leading to Arbitrary File Write
First seen Jul 18, 2026 · Updated Jul 18, 2026 · CVSS 8.8
IBM Langflow, an open-source visual builder for AI agent workflows, contains a path traversal flaw where a malicious flow can fetch attacker-controlled content and write it to arbitrary paths on the server via a crafted Content-Disposition header. An authenticated attacker can abuse this to overwrite configuration, code, or scheduled/startup files, likely leading to full compromise of the Langflow instance. This is a serious framework-level vulnerability requiring only low-privilege authenticated access.
Technical Analysis
The vulnerability lies in Langflow's flow-execution component that downloads remote content and derives the local save path from the server-supplied Content-Disposition filename field without sanitizing directory traversal sequences (e.g., '../../../'). An authenticated user can build a flow node pointing to an attacker-controlled HTTP endpoint that responds with a header specifying a traversal path, causing Langflow to write attacker-supplied file content outside the intended storage directory to any path writable by the Langflow process. This crosses the tool/execution boundary of the agent framework itself: what should be a sandboxed data-download tool becomes a primitive for writing executable code (e.g., cron jobs, WSGI/ASGI entrypoints, systemd units, or Python source files loaded by the app), enabling privilege escalation from authenticated-user to full remote code execution on the host. Because Langflow orchestrates agent pipelines and often has credentials/API keys and network access to other services, compromise of the underlying process can cascade into broader agent-to-agent or agent-to-tool trust abuse.
Affected Systems
IBM Langflow OSS
Detection Signatures
- Outbound HTTP requests from Langflow server to unexpected/newly-registered external domains during flow execution
- Content-Disposition headers containing '../' or absolute path sequences in HTTP responses to Langflow-initiated requests
- Unexpected file writes outside Langflow's designated data/upload directories (monitor via FIM on Langflow host)
- Newly created or modified files in application code, cron, systemd, or startup directories correlating with flow execution timestamps
- Flows referencing unfamiliar or attacker-controlled URLs as data sources
Remediation Steps
- 1
Upgrade Langflow
Apply the vendor patch/upgrade beyond version 1.10.0 once released; track IBM Langflow security advisories for the fixed version.
- 2
Sanitize filename inputs
If self-hosting an unpatched version, apply a reverse proxy or WAF rule to strip or reject Content-Disposition headers containing path traversal sequences on outbound-fetch responses.
- 3
Restrict flow creation privileges
Limit which authenticated users can create or edit flows with external URL/download components; apply least-privilege role separation in Langflow's auth model.
- 4
Sandbox the Langflow process
Run Langflow in a container or restricted user account with a read-only filesystem except for a narrowly scoped, non-executable upload directory.
- 5
Egress filtering
Restrict outbound network access from the Langflow host to an allowlist of known-safe destinations to prevent flows from reaching attacker-controlled servers.
- 6
File integrity monitoring
Deploy FIM on Langflow application directories to detect unauthorized writes to code, configuration, or startup files.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.