CVE-2026-9138: Langflow Path Traversal Vulnerability

CVE-2026-9138 Overview

CVE-2026-9138 is a path traversal vulnerability [CWE-22] in IBM Langflow OSS versions 1.0.0 through 1.11.2. The flaw resides in the SaveToFileComponent and stems from improper input validation when handling requests to the /api/v1/run/{flow_id} endpoint. An authenticated attacker with low privileges, such as a valid API key or user session, can supply crafted path values including absolute paths or path traversal sequences. This enables arbitrary file writes to any location writable by the Langflow process. Successful exploitation can lead to unauthorized file creation or modification and, depending on deployment context, further compromise of the host.

Critical Impact
Authenticated attackers can write arbitrary files anywhere the Langflow process has write access, enabling configuration tampering, code overwrite, and potential lateral compromise.

Affected Products

Langflow OSS versions 1.0.0 through 1.11.2
Deployments on Linux, Apple macOS, and Microsoft Windows
Applications embedding the vulnerable SaveToFileComponent

Discovery Timeline

2026-09-04 - CVE-2026-9138 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-9138

Vulnerability Analysis

Langflow is an open-source framework for building large language model (LLM) workflows. The SaveToFileComponent accepts a file path from flow execution input and writes generated content to disk. The component constructs local file paths using attacker-controlled input without sufficient sanitization. When a request hits the /api/v1/run/{flow_id} endpoint, the supplied path parameter is passed directly to file write logic.

An attacker submits absolute paths such as /etc/cron.d/malicious on Linux or C:\Windows\Temp\payload.dll on Windows. Path traversal sequences like ../../../../ also escape the intended output directory. The Langflow process writes the supplied content to the resolved location, bounded only by the filesystem permissions granted to the service account.

Exploitation requires authentication, which limits opportunistic attacks. However, Langflow deployments frequently share API keys across development teams or expose flows to internal automation. Attackers who obtain a low-privileged token gain a reliable write primitive against the underlying host.

Root Cause

The root cause is missing path canonicalization and allowlist enforcement in SaveToFileComponent. The component trusts caller-supplied file paths and does not validate that resolved paths remain within a designated output directory. There is also no rejection of absolute paths or .. segments before the write operation.

Attack Vector

The attack is network-reachable and requires an authenticated session or valid API key. An attacker crafts a JSON payload for the /api/v1/run/{flow_id} endpoint, targeting a flow that invokes SaveToFileComponent. The payload sets the destination path to a sensitive location such as a startup script, web root, Python site-packages directory, or SSH authorized_keys file. The Langflow process performs the write under its own user context.

No verified proof-of-concept exploit is publicly available at this time. See the IBM Support Page for vendor details.

Detection Methods for CVE-2026-9138

Indicators of Compromise

Unexpected file writes originating from the Langflow process to directories outside its configured output path
New or modified files in system directories such as /etc/cron.d/, ~/.ssh/, or Windows startup folders correlated with Langflow activity
HTTP requests to /api/v1/run/{flow_id} containing .., absolute path prefixes, or encoded traversal sequences in body parameters
Creation of executable scripts or shared libraries in directories loaded by other services on the host

Detection Strategies

Enable verbose request logging on the Langflow API and parse body parameters for path traversal patterns and absolute path indicators
Monitor filesystem activity from the Langflow service account using auditd on Linux or Sysmon FileCreate events on Windows
Correlate authenticated API sessions with subsequent file writes outside the expected output directory
Baseline normal SaveToFileComponent destinations and alert on deviations

Monitoring Recommendations

Forward Langflow access logs and host filesystem telemetry to a centralized analytics platform for correlation
Alert on writes by the Langflow process to any path containing cron, authorized_keys, .bashrc, or system binary directories
Track API key usage patterns and flag first-time invocation of flows containing SaveToFileComponent

How to Mitigate CVE-2026-9138

Immediate Actions Required

Upgrade Langflow OSS to a version later than 1.11.2 that addresses the SaveToFileComponent input validation flaw
Rotate all Langflow API keys and user credentials to invalidate any tokens exposed to untrusted parties
Audit existing flows for use of SaveToFileComponent and review historical file writes for suspicious destinations
Restrict network access to the Langflow API to trusted management networks only

Patch Information

Refer to the IBM Support Page for the fixed version and remediation guidance from the vendor. Apply the vendor-supplied update as the primary remediation path.

Workarounds

Run the Langflow process under a dedicated low-privilege user account with write access limited to a single output directory
Deploy Langflow inside a container or sandbox with a read-only root filesystem and a narrowly scoped writable volume
Place a reverse proxy in front of /api/v1/run/{flow_id} that rejects requests containing .., absolute paths, or encoded traversal sequences in the body
Disable or remove flows that invoke SaveToFileComponent until the patched version is deployed

bash

# Example: run Langflow as an unprivileged user with a restricted output directory
useradd -r -s /usr/sbin/nologin langflow
mkdir -p /var/lib/langflow/output
chown langflow:langflow /var/lib/langflow/output
chmod 750 /var/lib/langflow/output

# Systemd hardening for the Langflow service unit
# ProtectSystem=strict
# ReadWritePaths=/var/lib/langflow/output
# NoNewPrivileges=true
# PrivateTmp=true