CVE-2026-19303: Langflow Path Traversal Vulnerability

CVE-2026-19303 Overview

CVE-2026-19303 is a path traversal vulnerability [CWE-22] affecting IBM Langflow OSS versions 1.0.0 through 1.11.2. A remote authenticated attacker can delete arbitrary local files or directories on the host running Langflow. The flaw stems from improper limitation of a pathname to a restricted directory, allowing attackers to escape intended file system boundaries.

Langflow is a widely used open-source framework for building LLM-based applications and agent workflows. Successful exploitation can corrupt application state, remove configuration or model artifacts, and disrupt dependent AI pipelines.

Critical Impact
An authenticated remote attacker can delete arbitrary files and directories on Langflow hosts, resulting in loss of integrity and availability across Windows, macOS, and Linux deployments.

Affected Products

IBM Langflow OSS 1.0.0 through 1.11.2
Deployments on Linux, Apple macOS, and Microsoft Windows hosts
Downstream AI pipelines and agent workflows relying on Langflow-managed files

Discovery Timeline

2026-09-04 - CVE-2026-19303 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-19303

Vulnerability Analysis

The vulnerability resides in Langflow file-handling logic that accepts a user-supplied path parameter and passes it to a delete operation without proper canonicalization. An authenticated user can submit path components such as ../ sequences or absolute paths to reference files outside the intended working directory. The server then performs the delete against the resolved target on the underlying operating system.

Because the affected code path executes with the privileges of the Langflow process, an attacker can remove any file the service account can access. On typical deployments this includes application configuration, cached model artifacts, flow definitions, logs, and adjacent user data. Repeated deletions can render the service unusable and destroy forensic evidence.

The issue is authenticated but requires only low-privilege access, which is common in shared Langflow environments used by data scientists and developers.

Root Cause

The root cause is missing or insufficient validation of a pathname before it is used in a filesystem delete operation, classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Langflow does not enforce that the resolved path remains within an allowed base directory prior to invoking deletion.

Attack Vector

Exploitation occurs over the network against the Langflow HTTP API. The attacker authenticates with any valid account, then issues a crafted request containing traversal sequences in a path parameter. No user interaction is required, and the attack scope is unchanged. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-19303

Indicators of Compromise

HTTP requests to Langflow endpoints containing ../, ..\, URL-encoded %2e%2e%2f, or absolute path values in file-related parameters
Unexpected deletion of Langflow configuration files, flow JSON definitions, cached models, or log files
Application errors referencing missing files immediately after authenticated API activity
Deletion events on system directories initiated by the Langflow service account

Detection Strategies

Enable verbose access logging on the Langflow API and alert on path parameters containing traversal sequences or absolute paths
Correlate authenticated Langflow API calls with filesystem delete telemetry from the underlying host
Baseline normal file churn under the Langflow working directory and alert on deletions outside it

Monitoring Recommendations

Forward Langflow application logs and host filesystem audit events to a centralized analytics platform for correlation
Monitor process activity for the Langflow service account performing unlink, rmdir, or DeleteFile operations outside expected paths
Track authentication events and rate-limit anomalies from accounts issuing high volumes of file-management requests

How to Mitigate CVE-2026-19303

Immediate Actions Required

Upgrade Langflow to a fixed release above 1.11.2 as directed by the IBM Support Page
Restrict network access to the Langflow API so only trusted users and networks can reach it
Audit Langflow user accounts and revoke unused or shared credentials to reduce the authenticated attack surface
Back up Langflow configuration, flow definitions, and any persisted artifacts before applying changes

Patch Information

IBM has published remediation guidance for Langflow OSS on the IBM Support Page. Administrators should apply the vendor-recommended fixed version and validate that file-handling endpoints reject traversal input after the upgrade.

Workarounds

Run the Langflow process under a dedicated low-privilege service account with filesystem access limited to its working directory
Deploy Langflow inside a container or sandbox with read-only mounts for system directories and a minimal writable volume
Place a reverse proxy or web application firewall in front of Langflow to block requests containing path traversal patterns
Enforce strong authentication and role separation so that only trusted operators can invoke file-management APIs

bash

# Configuration example: run Langflow in a restricted container with a scoped writable volume
docker run -d \
  --name langflow \
  --read-only \
  --tmpfs /tmp:rw,size=64m \
  -v /srv/langflow/data:/app/data:rw \
  -u 10001:10001 \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  -p 127.0.0.1:7860:7860 \
  langflowai/langflow:latest