CVE-2026-42048: Langflow Path Traversal Vulnerability

CVE-2026-42048 Overview

Langflow is an open-source tool for building and deploying AI-powered agents and workflows. CVE-2026-42048 is a path traversal vulnerability [CWE-22] in the Knowledge Bases API endpoint DELETE /api/v1/knowledge_bases. The flaw exists because user-supplied knowledge base names are concatenated directly into filesystem paths without sanitization or boundary validation. An authenticated attacker can traverse outside the intended directory and delete arbitrary directories on the server's filesystem. The issue affects all Langflow versions prior to 1.9.0 and is fixed in 1.9.0.

Critical Impact

Authenticated attackers can delete arbitrary directories anywhere on the host filesystem, causing data loss and service disruption across the Langflow deployment.

Affected Products

• Langflow versions prior to 1.9.0
• Self-hosted Langflow deployments exposing the Knowledge Bases API
• Containerized Langflow instances using vulnerable image tags

Discovery Timeline

• 2026-05-12 - CVE-2026-42048 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-42048

Vulnerability Analysis

The vulnerability resides in the Knowledge Bases deletion handler exposed at DELETE /api/v1/knowledge_bases. Langflow accepts a knowledge base name from the authenticated client and uses that value directly when constructing the filesystem path passed to the deletion routine. Because the API does not strip traversal sequences such as ../ or enforce a canonical base directory, attackers can escape the intended knowledge base storage location.

Successful exploitation results in recursive deletion of any directory the Langflow process has permission to remove. This includes application files, model caches, configuration directories, and adjacent service data on the same host. Confidentiality is not directly affected, but integrity and availability are severely impacted because attackers can destroy production data and break the running service.

Root Cause

The root cause is missing input sanitization on a user-controlled identifier used as part of a filesystem path. The handler trusts the supplied name without normalizing the path or validating that the resolved location remains within the designated knowledge base root, which is the defining pattern of [CWE-22] Path Traversal.

Attack Vector

The attack is performed over the network against the Langflow HTTP API. The attacker must hold valid authenticated credentials, which is a low barrier in multi-tenant or shared Langflow deployments. The attacker issues a DELETE request to /api/v1/knowledge_bases with a knowledge base name containing directory traversal sequences. The server resolves the traversal and recursively removes the target directory.

No verified public exploit code is currently available. Refer to the GitHub Security Advisory GHSA-9whx-c884-c68q for vendor-provided details.

Detection Methods for CVE-2026-42048

Indicators of Compromise

• HTTP DELETE requests to /api/v1/knowledge_bases containing ../, ..%2f, or encoded traversal sequences in the knowledge base name parameter.
• Unexpected removal of directories outside the Langflow knowledge base storage root.
• Langflow application logs showing deletion operations referencing absolute paths or parent directory references.

Detection Strategies

• Inspect web server and reverse proxy access logs for DELETE requests against the Knowledge Bases API with suspicious path characters in the request body or URL.
• Enable filesystem auditing (auditd on Linux) on directories adjacent to the Langflow data path and alert on unexpected unlink or rmdir calls by the Langflow process.
• Correlate authenticated session activity with deletion API calls to identify abuse from compromised or low-privileged accounts.

Monitoring Recommendations

• Alert on any HTTP request to /api/v1/knowledge_bases whose payload contains .., URL-encoded traversal tokens, or absolute path prefixes.
• Monitor Langflow container or host for sudden mass-deletion events and integrity changes to non-knowledge-base directories.
• Track authentication events for the Langflow API and review accounts that issue knowledge base deletion requests at unusual rates.

How to Mitigate CVE-2026-42048

Immediate Actions Required

• Upgrade Langflow to version 1.9.0 or later, which contains the official fix.
• Restrict network exposure of the Langflow API to trusted users and internal networks until patching is complete.
• Audit existing Langflow user accounts and rotate credentials for any accounts that may be untrusted or shared.
• Back up Langflow data directories and verify backup integrity before applying changes.

Patch Information

The vulnerability is resolved in Langflow 1.9.0. The fix introduces proper sanitization and boundary validation on knowledge base names used in filesystem operations. Patch details are available in the Langflow GitHub Security Advisory GHSA-9whx-c884-c68q.

Workarounds

• Place Langflow behind a reverse proxy or web application firewall that blocks requests to /api/v1/knowledge_bases containing traversal sequences such as ../ or ..%2f.
• Run the Langflow process under a dedicated low-privilege user with filesystem access limited to its data directory.
• Disable or restrict the Knowledge Bases deletion endpoint via proxy rules until the upgrade can be applied.

# Example NGINX rule to block traversal patterns on the Knowledge Bases endpoint
location /api/v1/knowledge_bases {
    if ($request_method = DELETE) {
        if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e)") {
            return 403;
        }
    }
    proxy_pass http://langflow_backend;
}