A critical path traversal vulnerability in IBM Langflow OSS allows unauthenticated remote attackers to access sensitive files on the host system.

This vulnerability is a path traversal flaw (CWE-22) that enables an unauthenticated attacker to bypass directory restrictions and read arbitrary files via specially crafted requests.

The ability for an unauthenticated user to read arbitrary files poses a severe risk to confidentiality, potentially exposing configuration files, credentials, or sensitive application data. With a CVSS score of 7.5, this high-severity flaw could lead to full system compromise if sensitive environment variables or secrets are retrieved by an attacker.

Immediate Action: Upgrade IBM Langflow OSS to version 1.11.2 or later immediately as directed by the vendor.

Proactive Monitoring: Review web server and application access logs for suspicious patterns, such as the use of directory traversal sequences (e.g., ../) in URL parameters or API requests.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing path traversal payloads directed at the Langflow interface.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation and the potential for unauthorized data access, organizations running IBM Langflow OSS must prioritize the update to version 1.11.2. Failure to remediate this vulnerability leaves the environment exposed to attackers seeking to extract sensitive configuration or data files from the host.