CVE-2026-19302: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Langflow OSS

CVE-2026-19302 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.2. The vulnerability arises from improper validation of symbolic links, which can be exploited by a remote authenticated attacker to obtain sensitive information. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without integrity or availability impact. No vendor advisory or patch information is currently available.

An authenticated remote attacker can exploit this vulnerability to access sensitive information that should be restricted. The confidentiality of data is impacted, but integrity and availability are not affected. This could lead to unauthorized disclosure of sensitive data within the affected IBM Langflow OSS installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to symbolic link usage. Avoid exposing the affected versions to untrusted networks where possible.