high8.8Public exploit code
CVE-2026-5027
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary loc…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Langflow 1.8.4 - Path Traversal to Remote Code Execution2026-08-31 · webapps · multiple
Impact
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Langflow | Langflow | before 1.9.0 |