IBM Langflow Desktop versions 1.2.0 through 1.8.4 contain a CWE-22 path traversal vulnerability (CVE-2026-4502) that permits an authenticated attacker to traverse directories on the host system by sending specially crafted URL requests with "dot dot" sequences (/../). This can enable the attacker to write arbitrary files outside the intended restricted directories, potentially altering system or application files. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No vendor advisory or patch information is currently provided.

An authenticated attacker can exploit this vulnerability to write arbitrary files on the affected system by leveraging directory traversal sequences in URL requests. This compromises the integrity of the system or application by allowing unauthorized file modifications. There is no direct impact on confidentiality or availability reported. No known exploits are currently documented in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted parties only and monitor for suspicious activity related to file writes. Avoid exposing the vulnerable application to untrusted networks. Follow up with IBM for updates on patches or official mitigations.