Skip to content

Back to the catalog

Orca: CVE-2026-5027 Langflow Path Traversal RCE
orca.securityadvisory

Orca: CVE-2026-5027 Langflow Path Traversal RCE

CVE-2026-5027 (CVSS 8.8) is a path traversal vulnerability in Langflow's POST /api/v2/files upload endpoint, where the upload_user_file() function fails to sanitize filenames, allowing attackers to write arbitrary files anywhere on the filesystem. Because Langflow ships with unauthenticated auto-login enabled by default, a single unauthenticated request is enough to obtain a session and exploit it, escalating to RCE via cron job injection or config overwrite. Tenable disclosed it after failed vendor contact, VulnCheck has confirmed active exploitation against roughly 7,000 internet-exposed instances, and a public PoC exists; fixed in Langflow 1.9.0/1.10.0 and langflow-base 0.8.3.

TL;DR Unauthenticated path traversal in Langflow's file upload endpoint (CVE-2026-5027) enables arbitrary file write and RCE, now under active exploitation against ~7,000 exposed instances.
Open original ↗

CVEs named here

Technologies named here

Techniques named here

  • Path traversal via crafted filenames
  • Unauthenticated auto-login abuse
  • Path traversal

Threat actors named here

Related in AppSec