CVE-2026-4502 is a path traversal vulnerability in IBM Langflow Desktop versions 1.2.0 through 1.8.4. The flaw allows an authenticated attacker to exploit improper limitation of pathname input by sending crafted URL requests containing '/../' sequences. This can lead to arbitrary file write operations on the affected system. The vulnerability requires network access with low complexity and privileges, and does not require user interaction. Confidentiality is not impacted, but integrity is compromised due to the ability to write files. Availability is unaffected. No known exploits in the wild or vendor patches are currently documented.

An authenticated attacker can write arbitrary files on the system by exploiting the path traversal vulnerability. This compromises the integrity of the system by potentially allowing malicious files to be placed or legitimate files to be overwritten. There is no impact on confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user access to trusted users only and monitor for suspicious URL requests containing path traversal patterns. Avoid exposing the vulnerable service to untrusted networks.