CVE-2026-42048

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are concatenated directly into file paths without proper sanitization or boundary validation. An authenticated attacker can exploit this flaw to delete arbitrary directories anywhere on the server's filesystem, leading to data loss and potential service disruption. This vulnerability is fixed in 1.9.0.

• CWE-22

• https://github.com/langflow-ai/langflow/security/advisories/GHSA-9whx-c884-c68qExploit, Vendor Advisory
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-9whx-c884-c68qExploit, Vendor Advisory

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42042Axios is a promise based HTTP client for the browser and Nod…5.4
• CVE-2026-42043Axios is a promise based HTTP client for the browser and Nod…10
• CVE-2026-42044Axios is a promise based HTTP client for the browser and Nod…9.1
• CVE-2026-42045LobeHub is a work-and-lifestyle space to find, build, and co…6.2
• CVE-2026-42046libcaca is a colour ASCII art library. In 0.99.beta20 and ea…7.8
• CVE-2026-42047Inngest is a platform for running event-driven and scheduled…8.6
• CVE-2026-42049jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inser…8.4
• CVE-2026-4205A vulnerability has been found in D-Link DNS-120, DNR-202L, …9.8
• CVE-2026-42050ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-42051Kirby is an open-source content management system. Prior to …4.3
• CVE-2026-42052Beets is the media library management system. Prior to versi…6
• CVE-2026-42055NGINX Plus and NGINX Open Source have a vulnerability in the…9.2