CVE-2026-4502

Description

IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

PUBLISHED Reserved 2026-03-20 | Published 2026-04-30 | Updated 2026-05-01 | Assigner ibm

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

References

www.ibm.com/support/pages/node/7271097 vendor-advisory patch

cve.org (CVE-2026-4502)

nvd.nist.gov (CVE-2026-4502)

Download JSON