CVE-2026-14470: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Langflow OSS

CVE-2026-14470 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.2. An authenticated attacker can exploit this flaw by crafting URL requests containing "dot dot" sequences (/../) to traverse directories outside the intended restricted directory, potentially viewing arbitrary files on the system. The vulnerability does not require user interaction and has a low attack complexity but requires privileges of an authenticated user. The impact is confidentiality loss without affecting integrity or availability.

An authenticated attacker can read arbitrary files on the affected system by exploiting the path traversal vulnerability, leading to potential exposure of sensitive information. There is no impact on system integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM advisories for updates. In the meantime, restrict authenticated user access to only trusted users and consider additional access controls to limit exposure.