CVE-2026-9138: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Langflow OSS

CVE-2026-9138 is a path traversal vulnerability (CWE-22) in IBM Langflow OSS versions 1.0.0 through 1.11.2. The vulnerability arises from improper input validation in the SaveToFileComponent, which constructs local file paths from attacker-controlled input at the /api/v1/run/{flow_id} endpoint. An attacker with low-privileged authenticated access (e.g., valid API key or user session) can supply crafted path values including absolute paths or traversal sequences to write arbitrary files to any location writable by the Langflow process. This could lead to unauthorized file creation or modification and potentially further compromise depending on deployment specifics.

The vulnerability allows an authenticated attacker with low privileges to write arbitrary files to the server, which can lead to unauthorized file creation or modification. This may facilitate further compromise of the affected system depending on the deployment environment and file permissions. There is no direct confidentiality or availability impact reported, but integrity is impacted due to arbitrary file writes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated access to trusted users only and monitor for suspicious activity related to the /api/v1/run/{flow_id} endpoint. Avoid exposing the vulnerable endpoint to untrusted networks. Implement additional input validation or filtering at the application or network level if possible.