IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a path‑traversal flaw in the ChatInput, bundle FileInput, and GitExtractor components. An authenticated attacker can supply absolute paths or traversal sequences in the files parameter of a build request, causing the application to read arbitrary files from the server file system. The content is then embedded as a text attachment in the language model prompt and sent to the configured model endpoint, resulting in confidential data exfiltration. This bypasses the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS containment boundary that protects other file‑reading components. Consequently, secret keys, JWT signing material, application databases, environment data, and other tenants’ uploads are all susceptible to disclosure.

The vulnerability affects IBM Langflow OSS versions 1.0.0 up to and including 1.11.2. The fix is included in version 1.11.3 available on PyPI.

The CVSS score is 7.7, indicating a high impact if exploited. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is authenticated remote: an attacker who can authenticate to Langflow OSS can trigger the file‑read operation from the internal network, bypassing existing containment controls. The lack of an EPSS score does not negate the potential for exploitation, as the flaw permits direct reading of arbitrary files, a classic localsystem read exploit. The severity and the ease of credential acquisition make this a significant risk for confidentiality.