CVE-2026-4502 — Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API

CVE-2026-4502

Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API PUBLISHED

Description (CNA)

IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow Desktop	affected 1.2.0 through 1.8.4

CWE

CWE-22

References

https://www.ibm.com/support/pages/node/7271097

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.