CVE-2026-13445 is an authorization bypass vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.10.1) where the SaveToFile component improperly validates user-controlled file paths. An authenticated attacker can exploit this by specifying absolute paths to victim storage locations, enabling unauthorized reading and modification of other users' files. In append mode, the attacker reads victim file contents and uploads a combined file to their namespace, breaching confidentiality. In overwrite mode, the attacker replaces victim files with arbitrary data, breaching integrity. This vulnerability violates storage ownership boundaries and requires authenticated access.

The vulnerability allows an authenticated attacker to read sensitive data from other users' files and modify or overwrite those files. This results in confidentiality and integrity breaches within the affected system. There is no indication of availability impact. The vulnerability undermines user data isolation and could lead to unauthorized data disclosure and tampering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, restrict access to the SaveToFile component to trusted users only and monitor for suspicious activity involving file path manipulation. Avoid using absolute paths in workflows if possible.