← All Tags
# langflow → cve 2026 5027 → vulnerability → security → path traversal

1 link tagged with all of: langflow + cve 2026 5027 + vulnerability + security + path traversal

Click any tag below to further narrow down your results

+ file upload (1)

Links

Path traversal flaw in AI dev platform Langflow exploited in attacks

Attackers are exploiting CVE-2026-5027, a path traversal bug in Langflow’s file upload API, to write arbitrary files on exposed servers without authentication. The flaw, caused by unsanitized filenames, was patched in langflow-base 0.8.3 and Langflow 1.9.0 (upgrade to 1.10.0).
  • CVE-2026-5027 lets attackers write arbitrary files on Langflow servers with no authentication, via unsanitized filenames in the file upload API (path traversal using "../").
  • Langflow's unauthenticated auto-login means one request can grab a session token, making exploitation trivial.
  • VulnCheck honeypots have already detected live exploitation attempts, and Censys shows roughly 7,000 exposed instances.
  • Patched in langflow-base 0.8.3 and Langflow 1.9.0; users should update immediately to 1.10.0.
Last saved Jun 18, 2026 · 2 min read
langflow cve 2026 5027 path traversal + file upload security vulnerability