An authenticated path traversal vulnerability in IBM Langflow OSS allows attackers to exfiltrate critical server secrets and database files, posing a high risk to environment confidentiality.

This vulnerability is a path traversal flaw (CWE-22) in the file attachment pipeline. An authenticated attacker can supply crafted paths to the files parameter of a build request to bypass security boundaries and read sensitive system files.

Successful exploitation allows an attacker to retrieve highly sensitive information, including JWT signing keys, database contents, and environment variables. Given the CVSS score of 7.7, this represents a high-severity risk, as the exfiltration of these materials could lead to full account takeover, lateral movement, or complete compromise of the application infrastructure.

Immediate Action: Upgrade IBM Langflow OSS to version 1.11.3 or later as specified by the vendor.

Proactive Monitoring: Review application access logs for unusual build requests containing path traversal sequences, such as dot-dot-slash patterns, directed at the file attachment endpoint.

Compensating Controls: Ensure that the application is running with the least privilege necessary, specifically restricting the service account's ability to access sensitive system directories like /proc or configuration files.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the integrity and confidentiality of the Langflow environment. Organizations currently running versions 1.0.0 through 1.11.2 should prioritize upgrading to version 1.11.3 immediately to close the path traversal vector and prevent the potential exfiltration of critical system secrets.