Click any tag below to further narrow down your results
Links
Attackers are exploiting CVE-2026-5027, a path traversal bug in Langflow’s file upload API, to write arbitrary files on exposed servers without authentication. The flaw, caused by unsanitized filenames, was patched in langflow-base 0.8.3 and Langflow 1.9.0 (upgrade to 1.10.0).
- CVE-2026-5027 lets attackers write arbitrary files on Langflow servers with no authentication, via unsanitized filenames in the file upload API (path traversal using "../").
- Langflow's unauthenticated auto-login means one request can grab a session token, making exploitation trivial.
- VulnCheck honeypots have already detected live exploitation attempts, and Censys shows roughly 7,000 exposed instances.
- Patched in langflow-base 0.8.3 and Langflow 1.9.0; users should update immediately to 1.10.0.