CVE-2026-103360

Summary

The vulnerability allows authenticated attackers to access files outside of the intended directory through improper path handling, potentially exposing sensitive data like configuration files, credentials, or source code.

Exploitability

Exploitation requires an authenticated user account with access to the affected application, making it moderately difficult to exploit without prior access but achievable once credentials are obtained.

Blast radius

If exploited, this vulnerability could lead to exposure of sensitive system information including database credentials, API keys, and application configuration files across all affected Langflow versions.

Detection

Monitor for unusual file access patterns in application logs, particularly when users request files with paths containing '../' sequences, and watch for access attempts to system directories like /etc/, /var/, or /home/ that should be restricted.

Prioritized remediation

Upgrade to langflow version 1.12.3 or later to remediate the path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.