CVE-2026-13445: Langflow Path Traversal Vulnerability

CVE-2026-13445 Overview

CVE-2026-13445 affects IBM Langflow OSS versions 1.0.0 through 1.10.1. The vulnerability allows an authenticated attacker to abuse the SaveToFile component to read and modify files owned by other users. An attacker can specify absolute paths pointing to victim storage locations, bypassing the multi-tenant storage ownership boundary. This flaw is categorized as an Insecure Direct Object Reference issue [CWE-639].

Critical Impact
Authenticated attackers can breach confidentiality by exfiltrating another user's file contents through append mode, and violate integrity by replacing victim files in overwrite mode.

Affected Products

Langflow Langflow OSS 1.0.0 through 1.10.1
Deployments on Apple macOS, Linux, and Microsoft Windows hosts
Multi-tenant Langflow environments using the SaveToFile component

Discovery Timeline

2026-07-17 - CVE-2026-13445 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-13445

Vulnerability Analysis

The vulnerability resides in the SaveToFile component of Langflow OSS. The component accepts user-supplied file paths without enforcing tenant-scoped path restrictions. An authenticated user constructing a workflow can supply an absolute path that resolves to storage belonging to another user. The component then performs the requested operation using the Langflow service's file access privileges, not the tenant's own scope.

Two operating modes produce distinct impacts. In append mode, the workflow reads the victim's file contents, appends attacker-controlled data, and writes the resulting file into the attacker's namespace. This exfiltrates the victim's data. In overwrite mode, the component replaces the victim's file with attacker-supplied content, corrupting or planting data in the victim's storage.

Root Cause

The root cause is missing authorization on user-controlled object references [CWE-639]. Langflow trusts the path parameter passed to SaveToFile and does not validate that the resolved target belongs to the invoking user's namespace. There is no per-tenant path normalization or allow-list enforcement before I/O operations execute.

Attack Vector

The attack requires network access to the Langflow API and low-privilege authenticated credentials. No user interaction is required. An attacker builds a Langflow workflow that includes a SaveToFile node configured with an absolute path targeting another user's storage directory. Executing the workflow triggers the cross-tenant read or write. See the IBM Support Page for vendor details.

No verified proof-of-concept code is available. The vulnerability mechanism is described in prose per the vendor advisory.

Detection Methods for CVE-2026-13445

Indicators of Compromise

SaveToFile component invocations containing absolute paths that reference directories outside the invoking user's namespace.
Unexpected file creation events in a user's storage namespace containing data originating from another tenant.
File modification or overwrite events on victim storage without a corresponding action from the file owner.
Workflow definitions authored by low-privilege users that reference administrative or cross-tenant storage paths.

Detection Strategies

Audit Langflow workflow definitions for SaveToFile nodes using absolute paths or path traversal sequences.
Correlate workflow execution logs with file system audit events to identify cross-user access patterns.
Baseline normal per-user storage paths and alert on deviations that cross tenant boundaries.

Monitoring Recommendations

Enable verbose logging on the Langflow storage subsystem to capture path arguments passed to file components.
Monitor authentication logs for accounts creating unusually broad workflows targeting shared storage roots.
Track file integrity on shared Langflow storage volumes using host-based file integrity monitoring.

How to Mitigate CVE-2026-13445

Immediate Actions Required

Upgrade Langflow OSS to a release beyond 1.10.1 that addresses CVE-2026-13445 per IBM guidance.
Restrict Langflow account provisioning and revoke unused authenticated sessions until patching is complete.
Review historical workflow definitions containing the SaveToFile component for evidence of cross-tenant path usage.

Patch Information

Refer to the IBM Support Page for the vendor's official patch guidance and fixed version details. Apply vendor-supplied updates to all Langflow OSS instances running versions 1.0.0 through 1.10.1.

Workarounds

Disable or restrict the SaveToFile component through workflow policy where feasible.
Run Langflow in single-tenant deployments to eliminate cross-user storage exposure until patched.
Enforce filesystem-level ACLs that limit the Langflow service account to per-user directories.
Place Langflow behind an authentication gateway that restricts API access to trusted administrators.

bash

# Configuration example: restrict Langflow service to per-user directories
# Apply POSIX ACLs so the service cannot cross tenant namespaces
setfacl -R -m u:langflow:--- /var/lib/langflow/storage/shared
setfacl -R -m u:langflow:rwx /var/lib/langflow/storage/tenants/${TENANT_ID}