IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal. (CVE-2026-19299)

IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by a path traversal vulnerability (CWE-22) that allows a remote attacker with authentication privileges to obtain sensitive information by exploiting improper validation of file paths. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. No known exploits in the wild have been reported. No vendor advisory or patch information is currently provided.

A remote authenticated attacker can exploit the path traversal vulnerability to access sensitive information stored on the system. The vulnerability impacts confidentiality but does not affect integrity or availability. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and monitor for suspicious activity related to file access. Avoid exposing the affected versions to untrusted networks where possible.