CVE-2026-51888: Langflow Path Traversal Vulnerability

CVE-2026-51888 Overview

CVE-2026-51888 is an absolute path traversal vulnerability in langflow-ai Langflow version 1.8.4 and earlier. The flaw resides in the create_knowledge_base handler at src/backend/base/langflow/api/v1/knowledge_bases.py:51. The endpoint accepts an attacker-controlled path or filename and forwards it to file creation routines without enforcing a workspace boundary. An unauthenticated remote attacker can write or overwrite arbitrary files outside the intended working directory by submitting absolute paths to the knowledge base creation endpoint. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Remote, unauthenticated attackers can write arbitrary files anywhere the Langflow process has filesystem access, enabling configuration tampering, application file overwrite, and potential follow-on code execution.

Affected Products

langflow-ai Langflow version 1.8.4
langflow-ai Langflow versions prior to 1.8.4
Deployments exposing the /api/v1/knowledge_bases HTTP route

Discovery Timeline

2026-10-01 - CVE-2026-51888 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-51888

Vulnerability Analysis

Langflow exposes an HTTP POST route that creates a new knowledge base and provisions backing storage on the host filesystem. The handler at knowledge_bases.py:51 reads a path or filename value from the request body and passes it directly to file creation logic. No normalization, allow-list check, or containment within a designated workspace directory occurs before the write.

An attacker supplies an absolute path such as /etc/cron.d/langflow or /app/langflow/config.yaml as the knowledge base identifier. The server resolves the attacker-supplied path verbatim and writes content under the privileges of the Langflow process. This produces arbitrary file write anywhere the service account can reach, with no authentication required based on the stated attack vector.

Integrity impact is high because attackers can overwrite application code, startup scripts, or trusted configuration. Confidentiality and availability are not directly compromised by the write primitive itself, though follow-on code execution is practical once an attacker overwrites a Python module imported by Langflow or a scheduled task consumed by the host.

Root Cause

The root cause is missing path normalization and absence of a boundary check between the attacker-controlled input and the target filesystem location. The handler does not call a containment helper such as os.path.commonpath against a trusted base directory, nor does it reject inputs containing absolute path prefixes or .. traversal sequences.

Attack Vector

The attack surface is any network-reachable Langflow instance that exposes the /api/v1/knowledge_bases endpoint. The attacker sends a single HTTP POST request containing an absolute path in the field consumed by create_knowledge_base. Public proof-of-concept material is published at the GitHub Gist PoC, lowering the barrier to weaponization.

Detection Methods for CVE-2026-51888

Indicators of Compromise

HTTP POST requests to /api/v1/knowledge_bases containing absolute path characters, leading /, drive letters, or .. sequences in body parameters
Unexpected files appearing under system directories such as /etc, /var/spool/cron, /root, or inside the Langflow installation path with recent modification timestamps matching Langflow process activity
Langflow process writes to paths outside its configured workspace or data directory

Detection Strategies

Deploy a web application firewall rule that inspects JSON bodies on knowledge base routes and blocks values beginning with /, \\, or containing ../
Enable filesystem auditing (auditd on Linux, Sysmon FileCreate on Windows) scoped to the Langflow service account and alert on writes outside the designated workspace
Correlate HTTP access logs for the knowledge base endpoint with concurrent file creation events on sensitive paths

Monitoring Recommendations

Baseline normal file write locations for the Langflow process and alert on deviations
Monitor for new executable or script files inside Python site-packages used by Langflow
Track outbound connections initiated by the Langflow service after suspicious POST activity, which may indicate successful follow-on code execution

How to Mitigate CVE-2026-51888

Immediate Actions Required

Restrict network exposure of Langflow to trusted networks and place authentication in front of the /api/v1 routes using a reverse proxy
Run the Langflow process under a dedicated low-privilege account with no write access to system directories or application binaries
Review filesystem contents for unexpected files created since the service was first exposed to untrusted networks

Patch Information

No vendor patch is referenced in the published advisory data at the time of writing. Users of Langflow 1.8.4 and earlier should monitor the langflow-ai GitHub repository for a fixed release and upgrade as soon as one becomes available.

Workarounds

Block or filter requests to /api/v1/knowledge_bases at the reverse proxy until a patched version is deployed
Apply a reverse-proxy rule that rejects request bodies containing absolute paths or .. sequences in the knowledge base name field
Run Langflow inside a container with a read-only root filesystem and a tightly scoped writable volume for its workspace directory

bash

# Example nginx rule to block absolute paths and traversal in knowledge base requests
location /api/v1/knowledge_bases {
    if ($request_body ~* "(\"name\"\s*:\s*\"(/|\\\\|[A-Za-z]:|\.\./))") {
        return 403;
    }
    proxy_pass http://langflow_upstream;
}