CVE-2026-7667 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. An authenticated attacker can exploit this flaw by crafting a malicious flow that points to a URL under their control. This URL returns a Content-Disposition header with a filename parameter containing directory traversal sequences (e.g., "../../../target/path"), enabling the attacker to write arbitrary files with attacker-controlled content to any location accessible by the Langflow process. This improper limitation of pathname to a restricted directory (CWE-22) can result in arbitrary file write, potentially leading to full system compromise.

Successful exploitation allows an authenticated attacker to write arbitrary files to any path accessible by the Langflow process, impacting confidentiality, integrity, and availability. This can lead to unauthorized modification or creation of files, potentially enabling further attacks such as code execution or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Langflow OSS application to trusted users only and monitor for suspicious activity related to flow creation. Avoid using untrusted URLs in flows and consider additional application-level controls to validate or sanitize Content-Disposition headers if possible.