CVE-2026-5027
Langflow - Path Traversal Arbitrary File Write via upload_user_file
- Published
- Mar 27, 2026
- Updated
- Mar 27, 2026
- Assigning CNA
- tenable
- Evidence observed
- Aug 25, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 98.5%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
Sources
7- CVE-2026-5027Exploit
CVE-2026-5027
Langflow, Remote Code Execution (RCE) via Cron Job Injection through Path Traversal
Proof-of-concept exploit for CVE-2026-5027, a path traversal vulnerability in Langflow allowing arbitrary file write and potential remote code execution via crafted multipart filename.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.