CVE-2026-42048: Langflow knowledge bases API vulnerable to path traversal

# CVE-2026-42048: Langflow knowledge bases API vulnerable to path traversal

https://gcdradar.vercel.app/incidents/cve-2026-42048-langflow-knowledge-bases-api-vulnerable-to-pa · AIR-2026-0617 · closed 2026-05-05

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-05-05
- AI role: Attack on AI
- Products: Langflow
- CVE ids: CVE-2026-42048
- CVSS: 9.6

## Summary

Langflow suffered from a path traversal vulnerability in the knowledge bases API due to unsanitized user-supplied names. An authenticated attacker could exploit this to delete arbitrary directories on the server.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-05-12: CVE-2026-42048: Langflow is a tool for building and deploying AI-powered agents and workflows. (https://nvd.nist.gov/vuln/detail/CVE-2026-42048)
- 2026-05-05: CVE-2026-42048: Langflow Knowledge Bases API is Vulnerable to Path Traversal (https://github.com/advisories/GHSA-9whx-c884-c68q)

## Sources

- 2026-05-05 GitHub Advisory Database: CVE-2026-42048: Langflow Knowledge Bases API is Vulnerable to Path Traversal https://github.com/advisories/GHSA-9whx-c884-c68q
- 2026-05-12 NVD: CVE-2026-42048: Langflow is a tool for building and deploying AI-powered agents and workflows. https://nvd.nist.gov/vuln/detail/CVE-2026-42048

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.