CVE-2026-7667: Langflow Path Traversal Vulnerability

CVE-2026-7667 Overview

CVE-2026-7667 is a path traversal vulnerability [CWE-22] affecting Langflow OSS versions 1.0.0 through 1.10.0. An authenticated attacker can create a malicious flow that references an attacker-controlled URL. The remote server returns a crafted Content-Disposition header containing directory traversal sequences in the filename parameter. Langflow uses this filename without proper sanitization, allowing arbitrary file writes to any location accessible by the Langflow process. The attacker fully controls both the target path and the file contents.

Critical Impact
Authenticated attackers can write arbitrary files to any filesystem path writable by the Langflow process, enabling remote code execution, configuration tampering, and full host compromise.

Affected Products

Langflow OSS versions 1.0.0 through 1.10.0
Deployments running on Linux, macOS, and Microsoft Windows hosts
Any Langflow instance permitting authenticated flow creation

Discovery Timeline

2026-07-17 - CVE-2026-7667 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-7667

Vulnerability Analysis

The vulnerability resides in Langflow's file download handling logic. When a flow retrieves a remote resource, Langflow parses the HTTP Content-Disposition response header to determine the local filename. The parser extracts the filename parameter and concatenates it with a destination directory without normalizing or validating the resulting path.

An attacker who can authenticate to Langflow creates a flow that fetches a URL under their control. The attacker's server responds with a header such as Content-Disposition: attachment; filename="../../../etc/cron.d/payload". Langflow writes the response body to the traversed path with the privileges of the Langflow service account.

The issue combines unsafe input from an external HTTP response with a missing path canonicalization step. Because the write operation preserves attacker-supplied content, exploitation extends beyond information tampering to code execution through overwritten scripts, cron jobs, systemd units, or Python site-packages files.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Langflow trusts the filename value returned by a remote server and does not strip directory separators, resolve .. sequences, or enforce a chroot-style boundary before invoking the file write.

Attack Vector

Exploitation requires network access to the Langflow API and valid authentication credentials. The attacker submits a flow definition that instructs Langflow to download from an attacker-hosted endpoint. That endpoint returns a Content-Disposition header with filename="../../../target/path" and the malicious payload as the body. When the flow executes, Langflow writes the payload to the resolved absolute path. See the IBM Support advisory for vendor guidance.

// No verified public exploit code is available at time of publication.
// The exploitation pattern is described in prose above.

Detection Methods for CVE-2026-7667

Indicators of Compromise

Outbound HTTP requests from Langflow processes to unfamiliar or newly registered domains that return Content-Disposition headers
File creation or modification events in sensitive directories such as /etc/, /root/, ~/.ssh/, or Python site-packages originating from the Langflow process
New or modified files whose paths contain resolved .. traversal sequences in Langflow application logs
Unexpected cron entries, systemd unit files, or startup scripts appearing on Langflow hosts

Detection Strategies

Inspect Langflow application and HTTP client logs for response headers containing filename= values with ../, ..\, or absolute path prefixes
Correlate flow creation and execution events with subsequent file write telemetry on the host
Alert on any file write performed by the Langflow process outside of its designated data directory

Monitoring Recommendations

Enable filesystem auditing (auditd, Windows object access, or macOS EndpointSecurity) for the Langflow service user across sensitive directories
Log all outbound network destinations reached by Langflow and baseline them against expected integrations
Monitor Langflow authentication logs for new or unusual accounts creating flows that reference external URLs

How to Mitigate CVE-2026-7667

Immediate Actions Required

Upgrade Langflow OSS to a patched release beyond 1.10.0 as directed in the vendor advisory
Restrict Langflow authentication to trusted users and rotate credentials suspected of exposure
Run the Langflow process under a dedicated low-privilege service account with a narrowly scoped writable directory
Audit existing flows for references to external URLs and remove any that are not explicitly required

Patch Information

Refer to the IBM Support Page for Langflow for the fixed version and remediation instructions. Apply the vendor-supplied update to all Langflow OSS deployments in versions 1.0.0 through 1.10.0.

Workarounds

Place Langflow behind an egress proxy that strips or normalizes Content-Disposition headers on responses to Langflow
Enforce filesystem-level restrictions using mandatory access control (SELinux, AppArmor) or container read-only mounts to prevent writes outside the Langflow data directory
Disable or block flow components that fetch arbitrary remote URLs until the patch is applied

bash

# Example: run Langflow in a container with a read-only root filesystem
# and a single writable data volume to contain any traversal writes
docker run --read-only \
  --tmpfs /tmp \
  -v langflow_data:/app/data \
  --user 10001:10001 \
  --cap-drop ALL \
  langflowai/langflow:latest