CVE-2026-42867 is a path traversal vulnerability (CWE-22) in langflow-ai's langflow product affecting versions before 1.9.0. The issue arises because user-supplied knowledge base names are directly used to construct file paths without adequate sanitization or containment checks. An authenticated attacker can exploit this to write files and create directories arbitrarily on the server hosting langflow. This can lead to integrity and availability impacts. The vulnerability is resolved in version 1.9.0.

An authenticated attacker can exploit this vulnerability to write files and create directories anywhere on the server's filesystem, potentially leading to integrity and availability impacts. Confidentiality impact is not indicated. The CVSS 3.1 base score is 6.5 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts.

Upgrade langflow to version 1.9.0 or later, where this path traversal vulnerability is fixed. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, remediation depends on applying the official fix.