CyberRota Analysis
AI-GeneratedIBM Langflow OSS versions 1.0.0 to 1.10.0 are vulnerable to an authenticated attacker who can create a malicious flow that points to a controlled URL, leading to arbitrary file write operations due to a specially crafted Content-Disposition header. This vulnerability allows attackers to manipulate files on the server, potentially compromising sensitive data and system integrity. Organizations using affected versions should prioritize remediation to mitigate the risk of exploitation.
Original NVD Description
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary file write operations with attacker-controlled content to any path accessible by the Langflow process.
Related CVEs
Other vulnerabilities affecting the same vendor(s)