CVE-2026-13445
Last modified
CVE-2026-13445 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents, appends attacker-controlled data, and uploads a copy containing victim data to the attacker's namespace (confidentiality breach). EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents, appends attacker-controlled data, and uploads a copy containing victim data to the attacker's namespace (confidentiality breach). In overwrite mode, the attacker can replace victim file contents with arbitrary data (integrity breach). This breaks the storage ownership boundary between users.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Langflow | Langflow | >= 1.0.0, < 1.10.2 |
References
- https://www.ibm.com/support/pages/node/7279990Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-13445?
How severe is CVE-2026-13445?
How do I fix CVE-2026-13445?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1344Tanium addressed an insecure file permissions vulnerability …5.5
- CVE-2026-13440The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO,…7.2
- CVE-2026-13441The EventPrime – Events Calendar, Bookings and Tickets plugi…7.2
- CVE-2026-13442IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker …7.1
- CVE-2026-13443The Tutor LMS – eLearning and online course solution plugin …6.4
- CVE-2026-13444IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker …8.1
- CVE-2026-13446IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded cr…9.8
- CVE-2026-13448IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains a…9.8
- CVE-2026-13449IBM Business Automation Manager Open Editions 9.0.0 through …9.1
- CVE-2026-1345IBM Verify Identity Access Container 11.0 through 11.0.2 and…7.3
- CVE-2026-13450The GamiPress – Gamification plugin to reward points, achiev…5.3
- CVE-2026-13454The MotoPress Appointment Booking plugin for WordPress is vu…6.5
Are you affected by CVE-2026-13445?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST