KEVIntel
PRO Back to KEVs
8.8
CVSS
High

CVE-2026-5027

PUBLISHED

Langflow - Path Traversal Arbitrary File Write via upload_user_file

Exploited in the wild PoC available Remote Low complexity No user interaction
Vendor
langflow-ai
Product
langflow
Published
Mar 27, 2026
EPSS
0.0% · 11% pctl

Automate this intelligence with the Pro API

Everything on this page — CVSS, EPSS, exploit status, PoCs, scanner integrations, mentions, tags, and immediate honeypot data — is available programmatically for VM, SOC, and CTI workflows.

Learn about Pro

Description

The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').

Weaknesses (CWE)

  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores

CVSS v3.1 8.8 High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2026-06-10 16:20:36 UTC · TheHackerNews

Proof of concept available

Recorded 2026-04-02 10:46:45 UTC · GitHub

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
TheHackerNews First 2026-06-10 16:20 UTC

Recent mentions

Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE

TheHackerNews · Jun 10, 2026

A high-severity unpatched security flaw in Langflow, an open-source low-code platform to build artificial intelligence (AI) applications, has come under active exploitation in the wild, according to findings from VulnCheck. The vulnerability in question is CVE-2026-5027 (CVSS score: 8.8), a case of path traversal that could allow an attacker to write files to arbitrary locations. "The 'POST /

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

yahiahamza/CVE-2026-5027

github · Created 2026-04-02 10:46:45 UTC · 4 stars

CVE-2026-5027 - Langflow Path Traversal to Remote Code Execution (CVSS 8.8)

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Proof of Concept Exploit Available

  • Added to KEVIntel