Path traversal flaw in AI dev platform Langflow exploited in attacks
Short summary
Attackers are exploiting CVE-2026-5027, a path traversal bug in Langflow’s file upload API, to write arbitrary files on exposed servers without authentication. The flaw, caused by unsanitized filenames, was patched in langflow-base 0.8.3 and Langflow 1.9.0 (upgrade to 1.10.0).
- CVE-2026-5027 lets attackers write arbitrary files on Langflow servers with no authentication, via unsanitized filenames in the file upload API (path traversal using "../").
- Langflow's unauthenticated auto-login means one request can grab a session token, making exploitation trivial.
- VulnCheck honeypots have already detected live exploitation attempts, and Censys shows roughly 7,000 exposed instances.
- Patched in langflow-base 0.8.3 and Langflow 1.9.0; users should update immediately to 1.10.0.
Full summary
Attackers have begun exploiting CVE-2026-5027, a path traversal bug in Langflow’s file upload API, to drop arbitrary files on exposed servers. The flaw lives in the POST /api/v2/files endpoint, where the “filename” field isn’t sanitized. By slipping in “../” sequences, an attacker can overwrite or create files anywhere on the system. Tenable found the bug early this year, disclosed it on March 27, and only got a patch out after Snyk Security noted fixes in langflow-base 0.8.3 and Langflow 1.9.0 on March 30.
Langflow is a popular open-source tool for building AI apps and RAG workflows with drag-and-drop, not code. It’s starred over 149,000 times on GitHub and forks top 9,200. Researchers at VulnCheck say their honeypots saw live attempts to plant test files, and Censys scans show around 7,000 instances exposed (though that includes historical data). Since Langflow allows unauthenticated auto-login, attackers only need one request to grab a session token and start writing files. Users should update immediately to version 1.10.0, released today.