Threats tagged 'ghsa-54m9-hhxp-c88f'

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a vulnerability where an authenticated flow author can write attacker-controlled file content into any directory writable by the service account, bypassing local file access isolation. Additionally, an attacker can read arbitrary files accessible to the service process by using a crafted on-disk index, potentially exposing sensitive configuration files, secrets, or database files stored under the application's data directory.