CVE-2026-9138

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when handling requests to the /api/v1/run/{flow_id} endpoint. An attacker with low‑privileged authenticated access (such as a valid API key or user session) can supply crafted path values, including absolute paths or path traversal sequences, allowing arbitrary file writes to locations writable by the Langflow process. Successful exploitation may lead to unauthorized file creation or modification, potentially resulting in further compromise depending on the deployment environment.

• CWE-22

• https://www.ibm.com/support/pages/node/7285643Patch, Vendor Advisory

Published

Sep 4, 2026

Last Modified

Sep 10, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9132A missing authorization vulnerability was identified in GitH…6.5
• CVE-2026-9133Active debug code exists in the ARN resolver of amazon-mq ra…8.3
• CVE-2026-9134The FooGallery plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-9135IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up t…9.9
• CVE-2026-9136A vulnerability was identified in the ShadowAttribute propos…6.5
• CVE-2026-9137The CSP report endpoint in MISP intended to limit logged CSP…7.5
• CVE-2026-9139Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…9.8
• CVE-2026-9140A denial-of-service security issue exists in the 1719-AENTR.…8.7
• CVE-2026-9141Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…9.8
• CVE-2026-9142There is an insecure default credentials vulnerability in NI…9.3
• CVE-2026-9143There is an incorrect conversion between numeric types vulne…5.3
• CVE-2026-9144Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…8.4