IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a path traversal flaw and missing storage path validation that lets a remote authenticated attacker read arbitrary files. The weakness enables disclosure of any file the attacker can access through the filesystem, undermining confidentiality for the affected system

The vulnerability affects IBM Langflow OSS 1.0.0 through 1.11.5. Users of any of these releases are at risk if they allow authenticated access to the feature that processes file paths without verifying the target directory

The CVSS score of 6.5 categorizes the issue as moderate. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated to exploit it the necessary access. With valid credentials and the ability to craft a request containing a traversal sequence, the attacker can read any file accessible to the application’s process, potentially exposing sensitive system data.