CVE-2026-42048 is a path traversal vulnerability (CWE-22) in langflow-ai's Langflow product affecting versions before 1.9.0. The issue arises because user input for knowledge base names is concatenated directly into file paths without proper validation or sanitization. This allows an authenticated attacker to delete arbitrary directories on the server filesystem via the DELETE /api/v1/knowledge_bases API endpoint. The vulnerability has a CVSS 3.1 score of 9.6, indicating critical severity, with high impact on integrity and availability but no confidentiality impact. The vulnerability is fixed in version 1.9.0.

An authenticated attacker can exploit this vulnerability to delete arbitrary directories anywhere on the server's filesystem. This can result in significant data loss and disruption of service availability. There is no direct confidentiality impact reported. The high CVSS score reflects the critical nature of the integrity and availability impacts.

Upgrade Langflow to version 1.9.0 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade through the vendor's official release notes or repository. Until upgraded, restrict access to the Knowledge Bases API to trusted authenticated users only to reduce risk.