CVE-2026-93448: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Langflow OSS

CVE-2026-93448 describes a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2. This vulnerability arises from improper limitation of pathnames to restricted directories, enabling a remote attacker with authentication privileges to obtain sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact.

An authenticated remote attacker can exploit this vulnerability to access sensitive information outside intended directories, potentially leading to unauthorized disclosure of confidential data. There is no indication of impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM advisories for updates. Until a fix is available, restrict access to trusted users and consider additional access controls to limit exposure.