CVE-2026-7667 – Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing

CVE ID :CVE-2026-7667

Published : July 17, 2026, 7:21 p.m. | 16 minutes ago

Description :IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename=”../../../target/path” ), enabling arbitrary file write operations with attacker-controlled content to any path accessible by the Langflow process.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…