SecvalisbySYSDEVOPS.EU
CVE Catalog
EnglishPolski

CVE-2026-13445

HighCVSS 8.1
Published: Updated: Translated: NVD NIST

Exploitation Probability (EPSS)

Low risk
0.20%

10th percentile - higher than 10% of all known CVEs

Summary

IBM Langflow OSS versions 1.0.0 through 1.10.1 allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths to victim storage locations. In append mode, the attacker reads victim file contents, appends own data, and uploads a copy to their namespace. In overwrite mode, they can replace victim file contents with arbitrary data.

Risk Assessment

An attacker can breach the confidentiality and integrity of other users' data, breaking storage ownership boundaries.

Recommendation

Update IBM Langflow OSS to version 1.10.2 or later, which includes a fix for this vulnerability.

Other vulnerabilities in IBM Langflow OSS

See all
Original NVD description (English source)

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents, appends attacker-controlled data, and uploads a copy containing victim data to the attacker's namespace (confidentiality breach). In overwrite mode, the attacker can replace victim file contents with arbitrary data (integrity breach). This breaks the storage ownership boundary between users.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS