CVE-2026-7658

Katalog CVE

CVSS 6.5 · Medium EPSS 0,51%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada langflow. Skor CVSS 3.1 6.5 (Medium) menurut us.ibm.com.

Deskripsi (NVD)

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation.

Rincian

Terbit di NVD

5 Agustus 2026

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber us.ibm.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.ibm.com/support/pages/node/7282647 advisory vendor