CVE-2026-17621: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Langflow OSS

CVE-2026-17621 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.2. This flaw allows a remote attacker with limited privileges to traverse directories on the affected system by including "dot dot" sequences (/../) in a URL request, potentially exposing arbitrary files outside the intended restricted directory.

An attacker with network access and limited privileges can exploit this vulnerability to read arbitrary files on the system, potentially exposing sensitive information. The vulnerability does not allow privilege escalation or denial of service according to the CVSS vector, but confidentiality and integrity impacts are rated low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected service and monitor for suspicious URL requests containing directory traversal patterns.