Sign In
Advisories

Langflow < 1.9.0 Path Traversal via File Upload API

Go Back
severity
high
date
Affecting

  • Langflow < 1.9.0

CWE
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS
7.2
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
References
Credit
weblover
Description
Langflow before 1.9.0 contains a path traversal vulnerability in the API v2 file upload endpoint that allows authenticated attackers to write files to arbitrary filesystem locations by supplying crafted filenames containing path traversal sequences. Attackers can exploit insufficient path validation in the file storage service to overwrite sensitive files such as configuration, environment, source code, and database files accessible to the Langflow process.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo