The vulnerability is a path traversal flaw (CWE-22) in the file upload endpoint that fails to sanitize the 'filename' parameter from multipart form data. This allows an attacker to write files to arbitrary locations on the host filesystem. By creating or modifying system files, an attacker could inject malicious code or alter configuration files, violating the integrity principle and potentially enabling arbitrary code execution and full system compromise.

The vulnerability affects the Langflow product by langflow-ai. Any deployment exposing the POST /api/v2/files endpoint without proper filename sanitization is susceptible. No specific version numbers were supplied, so the impact may apply to all currently supported releases.

The CVSS score of 8.8 classifies the issue as high severity. The EPSS score of 31% indicates a moderate-to-high likelihood of exploitation, and the absence from the KEV catalog does not preclude exploitation. A crafted multipart/form-data request can target the upload endpoint; authentication requirements are not specified in the CVE data, and the lack of filename sanitization could allow an attacker with access to the endpoint to write files to arbitrary locations. This capability could enable exfiltration, planting of malicious files, or full system compromise.