CVE-2026-19302

Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow OSS	affected 1.0.0 through 1.11.2

CWE

CWE-22

References

https://www.ibm.com/support/pages/node/7285641

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.