Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
MEDIUM severity

Langflow: Path Traversal in Knowledge Bases API via Creation EndpointGHSA-79ph-745m-6wxq

MEDIUMFix: langflow-ai/langflow#12337

GHSA-79ph-745m-6wxq is a medium-severity (CVSS 6.5) Path Traversal vulnerability in langflow. A fix is available for langflow — see the affected versions and patch details below.

Also known asCVE-2026-42867PYSEC-2026-2566
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for GHSA-79ph-745m-6wxq.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs39th percentile — riskier than 39% of all scored CVEsHighest risk
0.00%0.32%0.64%0.97%0.3%0.3%0.5%0.5%0.5%Jul 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-79ph-745m-6wxq by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐍langflow

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.

Details

The vulnerability exists in the create_knowledge_base function within src/backend/base/langflow/api/v1/knowledge_bases.py.

This function constructs file paths directly from the user-supplied name field without sanitization. The value is concatenated with the user's base directory and passed directly to kb_path.mkdir(). Immediately following the directory creation, the application writes embedding_metadata.json and schema.json into this attacker-controlled path.

PoC (Proof of Concept)

For the Create endpoint, an attacker can supply traversal sequences or absolute paths in the name field:

../victim_user/evil_kb or /tmp/pwned

This forces kb_path.mkdir() to create directories and write specific application files (embedding_metadata.json and schema.json) at any reachable path on the server.

Impact

Any Langflow instance exposing this endpoint to authenticated users is vulnerable. This exposes the server to:

  • Cross-user data compromise: Creation of directories and files within another tenant's knowledge base space.
  • Arbitrary filesystem manipulation: Directory creation at any path on the server where the application has write permissions (e.g., /app/data).
  • Data overwrite: Overwriting existing embedding_metadata.json and schema.json files in attacker-targeted paths, potentially corrupting existing knowledge bases.

Fixes

The issue was addressed in PR #12337. The fix introduces the _validate_kb_path_containment() helper function, which uses Path.is_relative_to() instead of startswith() to enforce strict path boundaries and prevent prefix-ambiguity bugs. This helper is applied before any filesystem operations. Regression tests were added to verify that traversal payloads return a 403 Forbidden.

Acknowledgements

Thanks to the security researchers who responsibly disclosed this vulnerability:

  • @ddlxstudio
  • @nekros1xx

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIlangflowall versions1.9.0pip install --upgrade 'langflow==1.9.0'

Affected Products

1 product · 1 configurations
Application
langflowlangflow
< 1.9.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for langflow, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update langflow to 1.9.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-79ph-745m-6wxq is resolved across your whole dependency graph.

  3. Workarounds

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

## Summary Langflow is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem. ## Details The vulnerability exists in the `create_knowledge_base` function within `src/backend/base/langflow/api/v1/knowledge_bases.py`. This function constructs file paths directly from the user-supplied `name` fie
O3 Security · Impact-Aware SCA

Is GHSA-79ph-745m-6wxq in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Langflow: Path Traversal in Knowledge Bases API via…