A high-severity path traversal vulnerability in IBM Langflow OSS allows authenticated attackers to perform unauthorized file deletions, potentially leading to system instability or data loss.

The application suffers from improper limitation of a pathname to a restricted directory (CWE-22), which allows a remote attacker with authenticated access to escape the intended directory and delete local files or directories.

Successful exploitation of this vulnerability could lead to significant operational disruption, as an attacker can delete critical configuration files or application data. Given the CVSS score of 8.1, the vulnerability represents a high risk to business continuity and system integrity, as it allows for unauthorized modification and destruction of local resources.

Immediate Action: Upgrade to IBM Langflow OSS version 1.11.3 or later as specified by the vendor.

Proactive Monitoring: Review application and system access logs for unusual path traversal patterns or unauthorized deletion requests targeting sensitive directories.

Compensating Controls: Implement strict file system permissions for the service account running Langflow OSS to ensure it can only access and modify files necessary for its operation.

Public Exploit Available: No

The vulnerability poses a clear risk to the integrity of the hosting environment. Organizations should prioritize the update to version 1.11.3 to remediate this flaw and prevent potential unauthorized file destruction by authenticated users.