A path traversal flaw in IBM Langflow Desktop allows an authenticated attacker to send a specially crafted URL request containing "../" sequences to write arbitrary files on the system. This capability permits the creation of files in unintended locations, potentially including executable scripts or binaries, which can lead to remote code execution if the file is later executed by the service or an internal user. The weakness is a classic directory traversal (CWE‑22) and is categorized as a moderate to high severity vulnerability because it requires authentication but offers significant attack surface for compromising the host environment.

IBM Langflow Desktop versions 1.2.0 through 1.8.4, inclusive. The affected product is the IBM Langflow Desktop application.

The CVSS score of 6.5 reflects a medium to high risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited public exploitation data. The attack requires valid credentials and an endpoint to which the attacker can send crafted requests, making it an authenticated, network‑based attack vector. Successful exploitation could compromise the integrity of the system by allowing arbitrary file creation and potentially lead to remote code execution if the attacker controls execution of the written files.