Dashboard / CVE-2026-97677

CVE-2026-97677

HIGH
MEDIUM Priority: 0.03 BB Relevance: 66/100
Published: 2026-11-08 Modified: 2026-11-10 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: None

Description

IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process — including configuration files, secrets, or database files stored under the application's data directory.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
IBM Langflow OSS 1.0.0
IBM Langflow OSS 1.0.0
IBM Langflow OSS 1.0.0
langflow langflow 1.0.0 – 1.12.3

References & Advisories (1)

Bug Bounty Relevance

66 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploitation Probability

0.39%
Raw Score 0.003910
Percentile 33.7%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00391
2026-11-12
0.00391
2026-11-10
0.00402
2026-11-09
0.00402

Intelligence Sources

mitre ref →
nvd ref →

External Links