CVE-2026-42867
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem. This vulnerability is fixed in 1.9.0.
- Affected products
- Langflow
- Langflow
- < 1.9.0
- Fix
- Available
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 0.3% (27th percentile)
- Weakness
- CWE-22
- NVD status
- Analyzed
- Published
- 2026-06-23
CVE-2026-42867 at NVD
No indexed exploits for CVE-2026-42867 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-42867 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.