High severity8.8NVD Advisory· Published Mar 27, 2026· Updated Aug 18, 2026
CVE-2026-5027
CVE-2026-5027
Description
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:langflow:langflow:*:-:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:langflow:langflow:*:-:*:*:*:*:*:*range: <1.9.0
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
1- www.tenable.com/security/research/tra-2026-26nvdVendor AdvisoryThird Party Advisory
News mentions
10- Hackers Start Exploiting Critical Langflow VulnerabilitySecurityWeek · Sep 1, 2026
- Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 ActivityThe Hacker News · Sep 1, 2026
- Hackers Are Exploiting Nearly One in Four Vulnerabilities Before Defenders Get a CVECyber Security News · Jul 30, 2026
- CISA orders feds to prioritize patching Langflow auth bypass flawBleepingComputer · Jul 8, 2026
- CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEVThe Hacker News · Jul 8, 2026
- ⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and MoreThe Hacker News · Jun 15, 2026
- Critical Langflow Vulnerability Exploited to Execute Malicious CodeCyber Security News · Jun 11, 2026
- Hackers Exploit Langflow Vulnerability for Remote Code ExecutionSecurityWeek · Jun 11, 2026
- Path traversal flaw in AI dev platform Langflow exploited in attacksBleepingComputer · Jun 10, 2026
- Langflow Vulnerability CVE-2026-5027 Exploited for Unauthenticated RCEThe Hacker News · Jun 10, 2026