min8282/cve-2026-5027Proof-of-concept exploit for CVE-2026-5027, a path traversal vulnerability in Langflow allowing arbitrary file write and potential remote code execution via crafted multipart filename.
This post is a research article published by EQSTLab.
Thanks to Yahia Hamza, who reported and analyzed this vulnerability.
★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★
CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability
description: A path traversal vulnerability in Langflow <= 1.8.4 allows attackers to write arbitrary files outside the intended upload directory via a crafted multipart filename supplied to the /api/v2/files endpoint. In deployments where auto-login is enabled or authentication is otherwise weakly enforced, this issue may be leveraged to achieve remote code execution by writing attacker-controlled content to sensitive filesystem locations.
Build and run the vulnerable environment using Docker:
docker build -t cve-2026-5027 .
docker run --rm -it -p 9013:7860 --name cve-2026-5027 cve-2026-5027
# Non-destructive validation (proof file)
python3 CVE-2026-5027.py -t <HOST_IP>
# Validation with authenticated mode
python3 CVE-2026-5027.py -t <HOST_IP> -u <USERNAME> -p <PASSWORD>
Vulnerable Endpoint
POST /api/v2/files
The issue exists because the upload functionality trusts the multipart filename value provided by the client. Instead of generating a safe server-side storage name or constraining the resolved path to a dedicated upload directory, the vulnerable code path allows traversal sequences such as ../ to influence the final destination path.
As a result, an attacker can escape the intended storage root and force the application to write files to arbitrary locations on the server filesystem.
A representative exploitation flow is as follows:
/api/v2/files.filename containing path traversal sequences.This is fundamentally a CWE-22: Improper Limitation of a Pathname to a Restricted Directory issue.
The security flaw is caused by insufficient sanitization and validation of user-controlled file paths during upload handling. The application accepts the original client filename and passes it into the storage workflow without adequately enforcing path normalization and containment.
From a defensive standpoint, the dangerous pattern is conceptually similar to the following:
save_path = base_dir / file.filename
If file.filename contains path traversal components such as:
../../../../tmp/poc.txt
the final resolved path may point outside base_dir, enabling arbitrary file write.
Arbitrary file write vulnerabilities are often more severe than standard unrestricted upload issues because the attacker controls not only the file contents, but also the destination path. Depending on the runtime privileges of the Langflow process, this may enable:
Attacker --(Obtain access token or abuse auto-login)--> Langflow /api/v2/files --(Supply crafted multipart filename with ../)--> Arbitrary file write outside upload directory --(Write to sensitive location)--> Potential Remote Code Execution
This repository is not intended to facilitate unauthorized exploitation of Langflow instances. The purpose of this project is to help security researchers, defenders, and developers understand the vulnerability, validate exposure in controlled environments, and apply effective mitigations.