Path traversal flaw in AI dev platform Langflow exploited in attacks
Attackers are exploiting a path traversal bug in Langflow to write files on exposed servers. Users are urged to upgrade to version 1.10.0.
Intelligence analysis by GPT-5.4 Mini
Langflow, an open-source AI app and agent builder, is being targeted through CVE-2026-5027. The flaw lets attackers use a malformed filename in the file upload endpoint to write arbitrary files, and researchers say real-world exploitation is now underway.
Langflow has a hole that lets a bad actor sneak a file into places it should not go, like slipping a note under the wrong door. Security researchers say attackers are already trying it, so owners need to patch it fast.
Analysis
What happened
Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal flaw in Langflow's file upload handling. Tenable says the POST /api/v2/files endpoint fails to sanitize the filename field in multipart form data, which can let an attacker write files to arbitrary locations by using ../ path traversal sequences.
Why the risk is real
According to VulnCheck researcher Caitlin Condon, honeypots have already seen attackers dropping test files on vulnerable systems. The article notes that Langflow enables unauthenticated auto-login by default, so an attacker may not need valid credentials to reach the vulnerable endpoint. Condon also said Censys scans suggest about 7,000 publicly exposed Langflow instances, though those scans may include historical data and not reflect the current total.
Disclosure and remediation
Tenable says it found the issue early in the year and publicly disclosed it on March 27, 2026 after waiting more than two months for a response from the Langflow team. Snyk later reported that the problem was fixed in langflow-base 0.8.3 and in the Langflow application itself in version 1.9.0. The article says Langflow users should now upgrade to version 1.10.0, published the same day.
The exploitation of CVE-2026-5027 follows earlier attacks on other Langflow flaws this year, including CVE-2026-0770, CVE-2026-21445, and CVE-2026-33017. The piece also links the broader pattern to past exploitation warnings from CISA around CVE-2025-3248.
Key points
- Attackers are actively exploiting CVE-2026-5027 in Langflow.
- The flaw is a path traversal bug in the file upload endpoint.
- A malformed filename can let an attacker write files outside the intended directory.
- Researchers say exposed instances are reachable without credentials because auto-login is enabled by default.
- Langflow users are advised to upgrade to version 1.10.0.
If users move quickly to version 1.10.0, exposed systems can close off the path traversal weakness before more attackers reach them. The public reporting also gives defenders clear indicators to hunt for suspicious file writes and scan exposed instances.
If systems stay unpatched and publicly exposed, attackers may keep using the flaw to plant files and possibly set up follow-on access. The default unauthenticated auto-login makes weak deployments easier to abuse at scale.
