CVE-2026-14470: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM Langflow OSS

CVE-2026-14470 is a directory traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.2. An authenticated attacker can exploit this flaw by sending a URL containing dot-dot sequences (/../) to traverse directories and view arbitrary files on the system. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS 3.1 base score is 6.5, indicating moderate severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with authentication privileges can read arbitrary files on the affected system by exploiting the directory traversal flaw. This could lead to unauthorized disclosure of sensitive information. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict authenticated user access to trusted users only and monitor for suspicious URL requests containing directory traversal patterns.