CVE-2026-8183 describes a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3. The flaw allows remote attackers with low privileges to traverse directories on the affected system by exploiting improper limitation of pathname inputs. Attackers can send crafted URL requests containing '/../' sequences to view arbitrary files outside the intended directory scope. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity due to network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without integrity or availability impact. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker with low privileges can remotely exploit this vulnerability to access sensitive files on the system that should be restricted. This can lead to disclosure of confidential information. There is no indication of integrity or availability impact. The vulnerability affects confidentiality only, but with high impact due to arbitrary file access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected IBM Langflow OSS versions and monitor for suspicious URL requests containing directory traversal patterns. Consider implementing web application firewall rules to block traversal sequences as a temporary mitigation.