IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. (CVE-2026-17621)

IBM Langflow OSS versions 1.0.0 through 1.10.2 are affected by a directory traversal vulnerability (CWE-22) that permits remote attackers to traverse directories on the system by sending crafted URL requests containing dot-dot sequences (/../). This can lead to unauthorized viewing of arbitrary files on the affected system. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity) with attack vector network, low attack complexity, requiring low privileges and no user interaction, impacting confidentiality and integrity with no impact on availability. No patch or remediation information is currently provided.

An attacker with network access and low privileges can exploit this vulnerability to read arbitrary files on the system, potentially exposing sensitive information. The integrity of the system could also be affected due to unauthorized file access. There is no reported impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected service to trusted users and monitor for suspicious URL requests containing directory traversal patterns.