CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Langflow path traversal (POST /api/v2/files) -> arbitrary file write, pre-auth via default auto-login, exploited ITW

cve · CVE-2026-5027

Coverage
1
first 2026-06-11 → last 2026-06-14
Latest activity
2026-06-11
CVE-2026-5027, Langflow: unauthenticated path traversal to arbitrary file write, exploited in the wild
Peak priority
high
1 high
Targets
technology
sectors: technology
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-5027, newest first. Check the date before acting on an older one.

  • Patch Langflow (1.9.0 / 1.10.0) and disable auto-login (CVE-2026-5027). This pre-auth path-traversal-to-RCE is exploited in the wild with ~7,000 instances exposed. If patching is delayed, set LANGFLOW_AUTO_LOGIN=false, remove the instance from internet exposure, and hunt web logs for POST /api/v2/files requests containing ../ or %2e%2e%2f.
    2026-06-11CVE-2026-5027

Story timeline

  1. 2026-06-11CVE-2026-5027, Langflow: unauthenticated path traversal to arbitrary file write, exploited in the wild
    trending-vulnerabilities

Hunting pivots

Tags
actively-exploitedpatch-availablepath-traversalpre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • PersistenceServer Software Component: Web Shell

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-06-11/cve-2026-5027-langflow-unauthenticated-path-traversal-to-arb · ATT&CK page ↗

Persistence TA0003

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-06-11/cve-2026-5027-langflow-unauthenticated-path-traversal-to-arb · ATT&CK page ↗

Entries about Langflow path traversal (POST /api/v2/files) -> arbitrary file write, pre-auth via default auto-login, exploited ITW (1)

2026-06-11 · view entry permalink →

HIGHCVE-2026-5027exploited

CVE-2026-5027, Langflow: unauthenticated path traversal to arbitrary file write, exploited in the wild

CVE-2026-5027 (CVSS 8.8, CWE-22) is a path-traversal flaw in Langflow, the widely deployed open-source low-code platform for building LLM pipelines, RAG systems and agentic workflows. The POST /api/v2/files endpoint fails to sanitise the filename parameter in multipart form data, allowing ../ sequences to write files to arbitrary filesystem locations (BleepingComputer, 2026-06-10). It is effectively pre-authentication: Langflow ships with LANGFLOW_AUTO_LOGIN enabled by default, so a single unauthenticated request obtains a valid session token before reaching the file-write primitive, which chains to code execution via webshell placement or .pth injection. Tenable discovered and disclosed the flaw on 27 March 2026 after two months of unsuccessful vendor contact (Tenable TRA-2026-26, 2026-03-27); VulnCheck subsequently observed active exploitation in honeypots, with attackers staging test files on victim systems, and Censys data shows roughly 7,000 publicly exposed instances. A patch is now available (Langflow 1.9.0 / langflow-base 0.8.3, with 1.10.0 released 10 June). Technique: T1190 Exploit Public-Facing Application → T1505.003 Web Shell.

CVE Summary Table

CVE Product CVSS EPSS KEV Exploited Patch Source
CVE-2026-5027 Langflow (POST /api/v2/files) 8.8 n/a No Yes (VulnCheck) 1.9.0 / 1.10.0 BleepingComputer
CVE-2026-41089 Windows Netlogon (Server 2012–2025) 9.8 n/a No Yes (CCB Belgium) May 2026 Patch Tuesday CERT-EU 2026-007

CVE-2026-41089 is carried as a § 4 update, see below; it is listed here for the consolidated vulnerability view.

CVE-2026-5027 (CVSS 8.8, CWE-22) is a path-traversal flaw in Langflow, the widely deployed open-source low-code platform for building LLM pipelines, RAG systems and agentic workflows.

ctipilot v2 brief (migrated)
vulnerability11 Jun 05:00Zmulti-sourceOpen finding →
Sources: BleepingComputer · Tenable TRA-2026-26

explore in graph

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (33%)
  • cert.europa.eu1 (33%)
  • tenable.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)