Based on the description, it is inferred that the vulnerability in IBM Langflow OSS versions 1.0.0 to 1.9.1 allows remote code execution by permitting attackers to upload archive files containing symbolic links that point to arbitrary file system paths. The improper validation of these links during extraction enables unauthorized file access and potentially code execution, constituting a severe Path Traversal weakness (CWE‑22).

Affected are IBM Langflow OSS across all releases from version 1.0.0 through 1.9.1. The vendor recommends upgrading to version 1.9.2 to mitigate the issue.

Based on the description, it is inferred that the likely attack vector is the remote upload of malicious archive files. The critical severity is reflected in a CVSS score of 9.8, and the vulnerability is not listed in the CISA KEV catalog, though no EPSS data is available. Attackers can exploit the flaw by crafting and uploading archives that the application extracts without sufficient path validation, potentially allowing arbitrary file system access or execution of code on the host. The absence of mitigation controls means the threat is high if the software is publicly facing.