6.5
Moyenne
CVE-2026-7646 IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other…
Description
IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Langflow OSS 1.0 | 1.0.0 → 1.10.3 | Pas de correctif indiqué |
Autres CVE de Langflow OSS
Les 176 CVE de Langflow OSS →
CVE-2026-18894
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code…
6.5
Moyenne
CVE-2026-77817
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to…
6.5
Moyenne
CVE-2026-77819
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to…
6.5
Moyenne
CVE-2026-90991
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to…
6.5
Moyenne