The flaw is a classic path traversal vulnerability (CWE-22) that allows an unauthenticated remote attacker to read any file accessible to the web server process. By subverting the file path parameters in HTTP requests, an attacker can read configuration files, credentials or other sensitive operational data stored outside the intended webroot. This leads to the exposure of confidential information and can provide a foothold for further compromise if secrets are revealed.

IBM Langflow OSS, versions 1.0.0 through 1.11.1, which are distributed via the PyPI package manager and typically run in Python environments on web servers or containerized deployments.

The vulnerability carries a CVSS score of 7.5, indicating a moderate to high risk level. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. However, the attack vector is remote and requires only an HTTP request carrying a manipulated file path; no authentication or additional privileges are needed. A successful exploitation would grant the attacker read access to arbitrary files on the host system.