CVE-2026-51888

Executive Summary

CVE-2026-51888 is an absolute path traversal vulnerability in langflow-ai Langflow versions up to and including 1.8.4, exposed through the knowledge base creation HTTP endpoint (src/backend/base/langflow/api/v1/knowledge_bases.py, create_knowledge_base). A remote, unauthenticated-reachable HTTP route forwards attacker-controlled path or filename input to host file creation without enforcing a workspace or storage boundary, allowing arbitrary file write or overwrite outside the intended directory. Any internet- or network-exposed Langflow deployment at or below this version is affected, and because no patch or official workaround exists, the risk of file overwrite, application tampering, and potential code-execution chaining remains open.

Technical Analysis

Langflow is a low-code / visual framework for building LLM and agent-based applications, and it exposes HTTP API routes used to manage application resources such as knowledge bases. Per the NVD description, the affected component is the knowledge base creation endpoint implemented in src/backend/base/langflow/api/v1/knowledge_bases.py, specifically the create_knowledge_base handler (referenced at line 51 of that file in the second note). The vulnerability class is an absolute path traversal (CWE-22 family) with a directory traversal impact: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.

The mechanism is best characterized at the vulnerability-class level: the route accepts attacker-controlled path or filename material (as part of an HTTP request to the knowledge base creation endpoint) and forwards it into a host file creation operation without any visible boundary enforcement. The description explicitly states that the weakness is an absolute path traversal — meaning that input beginning with an absolute filesystem path (e.g., a leading path separator or drive/root reference) is not normalized, restricted, or rebased onto an intended workspace directory before being used. A correctly implemented control would canonicalize the incoming path, verify it resolves inside the allowed workspace/storage root, and reject anything else; the described flaw indicates that this boundary check is absent or ineffective.

Because the endpoint is described as a "live HTTP POST to create knowledge base," the attack surface is the HTTP or browser-backed service path exposed by the Langflow backend. No authentication or privilege requirement is stated in the provided intelligence, and because the request is a normal application API call, traversal input would typically be carried either in the request body or in a path/filename field consumed by the handler. The exact request parameter names are not given in the available description and are therefore not asserted here. The write primitive is "write or overwrite files outside the intended working directory," which distinguishes this from a read-only traversal — integrity on the host filesystem is directly at risk. The precise set of file extensions, ownership, or service account privileges that gate which paths are writable depends on how the Langflow process is deployed and is not specified in the provided data. No public PoC, exploit code, or Nuclei template is known, and no CVSS score or CWE mapping was provided by NVD; the vector shown in METADATA is a class-derived estimate for an unauthenticated network traversal write and should not be treated as an official NVD score.

Exploitation Scenarios

The following chain is inferred from the vulnerability class and the provided description; no public PoC is available, so exact request payloads and parameter names cannot be confirmed.

1. Reconnaissance / target identification. An attacker locates a reachable Langflow instance — an internet-facing deployment or one reachable from an adjacent network segment — and confirms the service and version (up to 1.8.4). Fingerprinting the HTTP service and its API surface, including the knowledge base endpoints, establishes that the vulnerable API path is exposed.

2. Triggering the flaw class. The attacker sends an HTTP POST to the knowledge base creation endpoint (src/backend/base/langflow/api/v1/knowledge_bases.py → create_knowledge_base) and supplies path/filename input that constitutes an absolute path (or otherwise escapes the intended workspace through traversal) rather than a name confined to the knowledge base storage root. Because the handler forwards this attacker-controlled value into host file creation without visible boundary enforcement, the boundary is bypassed at request-processing time.

3. Payload / execution method (class level). The payload is simply an absolute or traversal path targeting a file outside the intended working directory. Because the impact is arbitrary file write/overwrite, the attacker chooses a target path writable by the Langflow process. At the vulnerability-class level, an arbitrary-write primitive of this kind is commonly chained toward application tampering or, in the worst case, code execution (for example by overwriting files the application later loads or executes), but the provided description does not confirm any specific post-write execution path, and none is asserted here. No specific filename, extension, or endpoint parameter is identified in the source data.

4. Post-exploitation impact. Successful exploitation yields files created or overwritten outside the intended workspace/storage boundary on the host. Direct consequences include corruption or replacement of application files, configuration, or other resources accessible to the Langflow service account, and — depending on deployment — a foothold for further chaining. The full blast radius depends on the privileges of the Langflow process and its filesystem permissions, which are not specified in the available data.

Impact Assessment

The vulnerability provides a network-reachable, unauthenticated file-write primitive that crosses a trust boundary: input intended for a knowledge base resource is used to create files anywhere the Langflow process can write, not just inside the designated storage directory. The primary impacts are integrity (arbitrary write/overwrite) and availability (destruction or corruption of files the application depends on), which aligns with the class-derived vector's I:H and A:H. Confidentiality is not the described impact (the flaw is a write, not a read), so C:N is used.

Because Langflow is frequently deployed to support LLM/agent workloads and is often run with broad filesystem access or in container/cloud environments, the blast radius is proportional to the service account's write privileges. A misconfigured or root-run deployment magnifies the impact significantly. Affected systems are Langflow instances at version 1.8.4 and below with the knowledge base API reachable. CISA KEV status is NO, EPSS is not yet scored, and no official CVSS score is available; organizations should treat the effective severity as high given the unauthenticated network write primitive combined with the absence of a patch.

Detection Guidance

Sigma Rule

title: Langflow Knowledge Base Creation Path Traversal (CVE-2026-51888)
id: 7c9a1e2f-4b6d-4d3a-9f2b-5e8a1c6d0f31
status: experimental
description: Detects HTTP POST requests to the Langflow knowledge base creation endpoint containing absolute path or directory traversal sequences, indicating exploitation of CVE-2026-51888.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-51888
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - attack.t1006
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: '/knowledge_bases'
  selection_traversal:
    - cs-uri-query|contains: '..%2f'
    - cs-uri-query|contains: '../'
    - cs-uri-query|contains: '%2fetc%2f'
    - cs-uri-query|contains: 'file:'
    - cs-uri-query|contains: 'C:%5c'
  condition: selection_method and selection_uri and selection_traversal
falsepositives:
  - Legitimate administrative requests that reference paths outside the workspace (rare)
level: high

YARA Rule

rule CVE_2026_51888_Langflow_PathTraversal
{
    meta:
        description = "Detects absolute path traversal payloads targeting the Langflow knowledge base creation endpoint (CVE-2026-51888)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-51888"
        date = "2026-01-01"
        severity = "high"

    strings:
        $traversal1 = "../../" ascii wide nocase
        $traversal2 = "..\\..\\" ascii wide nocase
        $abs_unix   = "/etc/" ascii wide
        $abs_unix2  = "/root/" ascii wide
        $abs_win    = "C:\\" ascii wide nocase
        $kb_endpoint = "knowledge_bases" ascii wide nocase

    condition:
        $kb_endpoint and (1 of ($traversal1, $traversal2) or 1 of ($abs_unix, $abs_unix2, $abs_win))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-51888 Langflow Knowledge Base Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"knowledge_bases"; http.request_body; content:"../"; nocase; sid:202651888; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-51888; classtype:web-application-attack; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-51888;)

Elastic Detection

sequence by host.id, user.name with maxspan=5s
  [ network where network.direction == "inbound" and http.request.method == "POST"
    and http.request.body.text contains "../" ]
  [ file where event.action in ("creation", "modification")
    and not file.path : ("/tmp/*", "/var/lib/langflow/*") ]

Splunk SPL Query

index=web OR index=langflow
(http.method=POST OR cs-method=POST)
(uri_path="*knowledge_bases*" OR cs-uri-stem="*knowledge_bases*")
(uri_query="*..*" OR request_body="*../*" OR request_body="*%2e%2e*")
| stats count values(uri_path) as paths values(src_ip) as clients by host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,langflow,cve-2026-51888">
  <rule id="100518" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>knowledge_bases</url>
    <regex type="pcre2">\.\./|\.\.%2f|%2e%2e|C:%5c</regex>
    <description>CVE-2026-51888: Possible Langflow knowledge base path traversal attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list has been published by any tracked source, and no patch or upgrade target is available.

1. Immediate mitigations. Restrict network exposure of the Langflow HTTP service to trusted networks only; never expose it directly to the internet. Place it behind an authenticating reverse proxy or API gateway and require authentication/authorization for the knowledge base API routes. Enforce a strict allowlist of permitted paths and URI patterns at the proxy, blocking requests that contain absolute paths or traversal sequences (e.g., ../, encoded equivalents) targeting the knowledge base endpoints. If the endpoint is not required, disable it. Run the Langflow process with a dedicated low-privilege OS account and least-privilege filesystem permissions so that any traversal write cannot reach sensitive locations; use read-only mounts where feasible. Monitor the filesystem for unexpected file creation outside the intended workspace/storage directories.

2. Patch / upgrade steps. No patched version is known — no fix is currently available from any tracked source. Monitor the Langflow project repository, release notes, and vendor advisories for a security release addressing the knowledge base creation path traversal, and upgrade as soon as one is published. Do not assume the latest available version contains a fix until the vendor confirms it.

3. Long-term hardening. Adopt defensive input handling for all file-path-writing endpoints: canonicalize incoming paths, resolve symlinks, and verify the resolved path remains within an explicitly defined workspace/storage root before any file operation; reject absolute paths outright. Apply input validation and content-type/parameter allowlisting to all API handlers. Segment and containerize the Langflow service, enforce least privilege, and add continuous monitoring/alerting for file writes outside designated directories. Track CVE-2026-51888 for vendor updates and incorporate the detection rules above into SOC monitoring.

References

• NVD — CVE-2026-51888: https://nvd.nist.gov/vuln/detail/CVE-2026-51888
• Langflow project repository and security advisories: https://github.com/langflow-ai/langflow
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE ATT&CK T1006: Direct Volume Access / Path Traversal context: https://attack.mitre.org/techniques/T1006/

No public proof-of-concept, exploit code, or Nuclei template is known for CVE-2026-51888, and there is no CISA KEV entry or documented in-the-wild exploitation or named threat actor campaign at this time.