Langflow APIRequest Component Path Traversal via Content-Disposition Header
First seen Jul 20, 2026 · Updated Jul 20, 2026 · CVSS 9.9
Langflow's APIRequest component, when its 'Save to File' feature is enabled, trusts filenames supplied by an external HTTP server's Content-Disposition header without sanitizing them. A malicious or compromised remote endpoint can inject path traversal sequences to write arbitrary files outside the intended temporary directory, potentially leading to full remote code execution on the host running the agent flow.
Technical Analysis
The APIRequest tool component allows an agent flow to make outbound HTTP requests and persist responses to disk. The filename used for the saved file is derived directly from the Content-Disposition header returned by the remote server and concatenated with the temp directory path without validation or normalization. An attacker who controls the destination server (or performs a MITM/SSRF-style redirection to one) can return a header such as filename="../../../../etc/cron.d/malicious" to escape the intended directory. This crosses the boundary from an untrusted external data source (HTTP response metadata) into the agent's local filesystem, allowing arbitrary file overwrite/creation with the privileges of the Langflow process — a classic tool-output-to-filesystem trust failure in agentic pipelines that can escalate to full code execution (e.g., overwriting cron jobs, service configs, or startup scripts).
Affected Systems
IBM Langflow OSS
Detection Signatures
- Content-Disposition headers containing '../' or '..\\' sequences or absolute paths
- Langflow logs showing file writes outside expected temp/output directories
- APIRequest component network responses from unexpected or newly-registered external domains
- Unexpected file creation/modification in system directories correlating with Langflow process activity
- Outbound HTTP requests from Langflow flows to attacker-controlled or unverified endpoints
Remediation Steps
- 1
Upgrade Langflow
Apply the vendor patch/upgrade to a Langflow version that sanitizes Content-Disposition-derived filenames (validate against path traversal, strip directory components, enforce basename-only usage).
- 2
Restrict Save to File feature
Disable the 'Save to File' option in APIRequest components unless strictly necessary, and if enabled, run Langflow with least-privilege filesystem permissions.
- 3
Sandbox outbound HTTP targets
Enforce allowlists for destinations the APIRequest component may contact to prevent arbitrary or attacker-controlled servers from being reached.
- 4
Filesystem isolation
Run Langflow in a container or chroot with a restricted, ephemeral filesystem and no write access to sensitive system paths.
- 5
Input validation hardening
Independently validate and canonicalize any filename or path derived from external/untrusted response data before use in filesystem operations, rejecting any path containing traversal sequences.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.