CVE-2026-5027
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
Early warning: exploitation observed
- Exploitation observed since Jun 8, 2026
- Not yet in the official CISA catalogue
- First attack observed 72 days after disclosure
- Confirmed by sensors, not only by reports
Source: VulnCheck KEV · Aug 31, 2026 Aug 29, 2026 Aug 28, 2026 Aug 28, 2026 Aug 24, 2026 Aug 10, 2026
CVSS score8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-22
Vendorslangflow
Affected products
| Vendors | Prodotto | Versioni |
|---|---|---|
| langflow | langflow | < 1.9.0 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.