CVE-2026-8859: Langflow Path Traversal Vulnerability

CVE-2026-8859 Overview

CVE-2026-8859 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw exists in the APIRequest component when the "Save to File" feature is enabled. Langflow extracts filenames from HTTP response Content-Disposition headers without sanitization before joining them to the temporary directory path. An attacker who controls an external HTTP server queried by Langflow can supply filenames containing ../ sequences. This enables arbitrary file writes to any location accessible by the Langflow process, categorized under [CWE-22].

Critical Impact
Authenticated attackers can achieve arbitrary file write across the host, leading to remote code execution and full compromise of the Langflow environment.

Affected Products

Langflow OSS versions 1.0.0 through 1.10.0
Deployments on Linux, macOS, and Microsoft Windows hosts
Any Langflow flow using the APIRequest component with "Save to File" enabled

Discovery Timeline

2026-07-17 - CVE-2026-8859 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-8859

Vulnerability Analysis

The vulnerability lives in Langflow's APIRequest component, which issues outbound HTTP requests as part of a flow. When "Save to File" is enabled, the component persists the response body to disk under a temporary directory. Langflow derives the output filename from the Content-Disposition header returned by the remote server. The extracted filename is joined directly to the base path without validating that the result stays inside the intended directory.

Because the filename is attacker-controlled and unsanitized, ../ traversal sequences allow the resulting path to escape the temporary directory. The write occurs with the privileges of the Langflow process, which typically owns configuration files, flow definitions, and application binaries. Arbitrary file write in this context is a direct path to code execution through overwriting startup scripts, Python site-packages, or scheduled task files.

Root Cause

The root cause is improper input validation of externally supplied data used in filesystem path construction. Langflow trusts the Content-Disposition header value and passes it through path-join logic without normalization or containment checks against the intended base directory.

Attack Vector

An attacker with the ability to trigger an APIRequest flow, or who can influence the destination URL of an existing flow, points the component at a server they control. The malicious server returns a response with a header such as Content-Disposition: attachment; filename="../../../../etc/cron.d/langflow_rce". Langflow writes the response body to that traversed location, granting the attacker persistent execution paths on the host.

Exploitation requires low-privileged access to trigger the flow but does not require user interaction. The vulnerability description does not include verified public exploit code, so no proof-of-concept is reproduced here.

Detection Methods for CVE-2026-8859

Indicators of Compromise

Files written outside the Langflow temporary directory by the Langflow process user, particularly in /etc/, /root/, home directories, or Python site-packages
Outbound HTTP requests from Langflow to unexpected external hosts followed by local file creations
HTTP response captures containing Content-Disposition filenames with ../, ..\, or absolute path prefixes
New or modified cron entries, systemd units, or startup scripts owned by the Langflow service account

Detection Strategies

Monitor the Langflow process for file creation events with paths that resolve outside its designated working directory
Inspect Langflow application logs for APIRequest component executions correlated with unusual destination URLs
Deploy network inspection rules that flag responses containing traversal sequences in Content-Disposition headers
Baseline expected outbound destinations for Langflow and alert on deviations

Monitoring Recommendations

Enable filesystem auditing (auditd on Linux, Sysmon on Windows) for writes by the Langflow service account
Forward Langflow container or process logs to a centralized SIEM for correlation with network telemetry
Alert on any modification of system-level configuration files by non-root application processes

How to Mitigate CVE-2026-8859

Immediate Actions Required

Upgrade Langflow OSS to a fixed release above 1.10.0 as directed in the IBM Support Page
Audit existing flows for use of the APIRequest component with "Save to File" enabled and disable where not required
Restrict Langflow's outbound network access to a known allowlist of trusted API endpoints
Run Langflow under a dedicated low-privilege service account with a read-only application directory

Patch Information

IBM has published remediation guidance for CVE-2026-8859 on the IBM Support Page. Administrators should apply the vendor-supplied fixed version for Langflow OSS and verify the APIRequest component sanitizes filenames after the update.

Workarounds

Disable the "Save to File" option on all APIRequest components until patching is complete
Place Langflow behind an egress proxy that strips or normalizes Content-Disposition headers on inbound responses
Enforce mandatory access controls (SELinux, AppArmor) that confine Langflow writes to a specific directory tree
Isolate Langflow in a container with a read-only root filesystem and a bounded writable volume