IBM Langflow Desktop versions up to 1.8.4 contain a CWE-22 path traversal vulnerability that permits remote attackers with limited privileges to traverse directories outside the intended restricted directory. By crafting URL requests with dot-dot sequences (/../), attackers can access arbitrary files on the system. The vulnerability has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, and partial privileges required, with high confidentiality impact but no integrity or availability impact. No official patch or remediation level has been disclosed by IBM as of the publication date.

Successful exploitation allows an attacker with limited privileges to read arbitrary files on the system running IBM Langflow Desktop 1.8.4 or earlier. This can lead to unauthorized disclosure of sensitive information, potentially compromising confidentiality. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected application to trusted users only and monitor for suspicious URL requests containing directory traversal patterns. Avoid exposing the application to untrusted networks. Follow IBM advisories for updates.