CVE-2026-7667 describes a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. An authenticated attacker can exploit this flaw by crafting a malicious flow that references a URL under their control. This URL returns a Content-Disposition header with a filename parameter that includes directory traversal sequences (e.g., "../../../target/path"), enabling the attacker to write arbitrary files with attacker-controlled content to any location accessible by the Langflow process. This vulnerability can lead to full compromise of the affected system due to arbitrary file write capabilities.

Successful exploitation allows an authenticated attacker to write arbitrary files to any path accessible by the Langflow process, potentially leading to code execution, data corruption, or system compromise. The vulnerability affects confidentiality, integrity, and availability, as reflected by the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to limit the ability to create malicious flows and monitor for suspicious activity involving flow creation referencing external URLs with crafted Content-Disposition headers.