CyberRota Analysis
AI-GeneratedIBM Langflow OSS versions 1.0.0 to 1.10.0 are vulnerable due to improper input validation in the APIRequest component, allowing attackers to exploit a path traversal vulnerability through the "Save to File" feature. This flaw enables the writing of arbitrary files to unintended locations, potentially compromising sensitive data or system integrity. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of unauthorized file access and manipulation.
Original NVD Description
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HTTP response Content-Disposition headers are not sanitized before being joined to the temporary directory path. An attacker controlling an external HTTP server can supply crafted filename values containing path traversal sequences (e.g., ../), enabling arbitrary file writes to locations accessible by the Langflow process.
Related CVEs
Other vulnerabilities affecting the same vendor(s)