CVE-2026-7869 is a path traversal vulnerability (CWE-22) affecting IBM Langflow OSS versions 1.0.0 through 1.10.3. The issue arises because the Knowledge Bases API (`POST /api/v1/knowledge_bases`) uses user-supplied knowledge base names directly to construct file paths without adequate sanitization or containment checks. An authenticated attacker can exploit this to create directories and write arbitrary files anywhere on the server's filesystem, potentially leading to unauthorized file manipulation. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. There is no vendor advisory or patch information available at this time.

An authenticated attacker can leverage this vulnerability to write files and create directories arbitrarily on the server hosting IBM Langflow OSS. This can lead to unauthorized modification or addition of files, potentially compromising the integrity and confidentiality of the system. Availability is not impacted according to the CVSS vector. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Knowledge Bases API to trusted users only and monitor for suspicious activity related to file creation or modification. Avoid exposing the vulnerable API endpoint to untrusted networks.