Langflow SaveToFileComponent Path Traversal / Arbitrary File Write
First seen Sep 7, 2026 · Updated Sep 7, 2026 · CVSS 6.5
Langflow OSS versions 1.0.0 through 1.11.2 contain a path traversal flaw in the SaveToFileComponent that lets an authenticated, low-privileged user write files to arbitrary locations on the server via the /api/v1/run/{flow_id} endpoint. This is a classic input validation failure in an agent-building tool component rather than a novel agentic attack, but it can be leveraged to escalate into further server compromise depending on deployment. Severity is moderate due to the authentication requirement, but risk increases sharply in multi-tenant or exposed Langflow deployments.
Technical Analysis
The vulnerability lies in how the SaveToFileComponent constructs local file paths from user-supplied flow parameters without sanitizing for absolute paths or '../' traversal sequences. An authenticated attacker (holding any valid API key or session) can submit a crafted flow execution request to /api/v1/run/{flow_id} specifying a malicious output path, causing the Langflow process to write or overwrite files outside the intended working directory. Because Langflow components run with the privileges of the backend process and are often chained into automated pipelines, this crosses the tool-execution boundary between the agent orchestration layer and the underlying filesystem, potentially enabling overwrite of configuration files, cron jobs, SSH keys, or web-accessible paths that lead to code execution. The flaw does not require prompt injection or model manipulation — it is a direct component-level input validation gap reachable through the standard flow-execution API surface.
Affected Systems
Langflow (IBM Langflow OSS)
Detection Signatures
- Requests to /api/v1/run/{flow_id} containing file path parameters with '../' sequences or absolute paths (e.g., '/etc/', 'C:\\', leading '/')
- Unexpected file creation/modification outside Langflow's designated data/output directories
- SaveToFileComponent invocations with path parameters differing from configured safe storage roots
- Anomalous file writes correlated with authenticated API sessions from non-admin users
Remediation Steps
- 1
Upgrade Langflow
Update to a patched Langflow release beyond 1.11.2 that addresses this CVE.
- 2
Restrict file path inputs
Apply strict allow-listing and canonicalization of file paths in SaveToFileComponent and any similar file-writing components; reject absolute paths and traversal sequences.
- 3
Sandbox component execution
Run Langflow's flow-execution backend with a least-privilege service account and a chroot/container filesystem restricting writable paths.
- 4
Audit authenticated access
Review and tighten API key issuance and session privileges; monitor for low-privileged accounts invoking file-write components.
- 5
Enable file integrity monitoring
Deploy FIM on directories writable by the Langflow process to detect unauthorized file creation or modification.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.