CVE-2026-5027 is a CWE-22 path traversal vulnerability in langflow-ai langflow. The vulnerability arises because the 'POST /api/v2/files' endpoint fails to properly sanitize the 'filename' parameter in multipart form data. An attacker can exploit this by including path traversal sequences ('../') in the filename, enabling arbitrary file write to locations outside the intended directory. This can result in complete system compromise including data disclosure, modification, and denial of service.

Successful exploitation allows an attacker with at least low privileges to write arbitrary files anywhere on the filesystem accessible to the application. This can lead to full confidentiality, integrity, and availability impact, including arbitrary code execution, data tampering, and service disruption.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the vulnerable endpoint to trusted users only and monitor for suspicious activity related to file uploads.