CVE-2026-12942 is a path traversal vulnerability in IBM Langflow OSS that allows remote attackers to bypass directory restrictions by using specially crafted URL requests containing '../' sequences. This enables attackers to view arbitrary files on the affected system without requiring authentication. The vulnerability affects IBM Langflow OSS version 1.0.0 and potentially up to 1.10.1. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, no privileges required, no user interaction, and high confidentiality impact. No official patch or remediation guidance has been published by IBM as of the data provided.

An attacker can remotely access arbitrary files on the system running IBM Langflow OSS by exploiting the path traversal vulnerability. This compromises confidentiality by exposing sensitive files. There is no impact on integrity or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected IBM Langflow OSS instances, monitor for suspicious URL requests containing directory traversal patterns, and consider implementing web application firewall rules to block such requests.