A path traversal flaw in the file upload endpoint allows an attacker to write files to any location on the host filesystem. The flaw enables creation or modification of system files, potentially allowing malicious code injection or alteration of configuration files. This violates the integrity principle and could be used to execute arbitrary code, leading to full system compromise.

The vulnerability affects the Langflow product by langflow‑ai. Any deployment exposing the POST /api/v2/files endpoint without proper filename sanitization is susceptible. No specific version numbers were supplied, so the impact may apply to all currently supported releases.

The CVSS score of 8.8 classifies the issue as high severity. EPSS data is unavailable, but the absence from the KEV catalog does not preclude exploitation. The likely attack path involves sending a crafted multipart/form-data request to the upload endpoint; while authentication requirements are not explicitly stated, the lack of sanitization suggests that an attacker could leverage the flaw even with limited privileges. Exfiltration or planting of malicious files could lead to system compromise.