The vulnerability is an unauthenticated file‑upload flaw that permits an attacker to upload files without authentication, causing uncontrolled disk space consumption and path disclosure. The primary impact is a denial of service through disk exhaustion, while the disclosure of file system paths may aid attackers in locating additional targets or sensitive files. This weakness is classified as CWE‑400, uncontrolled resource consumption.

All releases of IBM Langflow OSS from version 1.0.0 up to and including 1.9.0 are affected. The vulnerability applies to the file‑upload feature present in those releases, regardless of the specific runtime environment used.

The CVSS score of 7.1 indicates a high‑moderate risk. EPSS is not available and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, given the unauthenticated nature of the file upload endpoint. An attacker can repeatedly or massively upload files to exhaust disk space, thereby disrupting service availability. No special privileges are required beyond the ability to reach the upload interface.