Skip to content

CVE-2026-5027

Named by 3 kept items in this workspace.

Search every workspace for CVE-2026-5027. It matches the name as written, so it can find other things that share it.

The items that name it 3

  • Vulnerability Discovery and Exploitation Trends in the AI Era (Google Cloud)
    article2026-09-30

    Path traversal file write in Langflow's POST /api/v2/files upload handler, allowing remote threat actors to drop unauthorized files (e.g., cron jobs, SSH keys) onto the host. Rated High Threat Risk; confirmed exploited in the wild.

  • AI Security Briefing
    advisory2026-07-18

    Langflow flaw exploited by bad actors over the past year.

  • Orca: CVE-2026-5027 Langflow Path Traversal RCE
    advisory2026-06-12

    High-severity path traversal in Langflow's POST /api/v2/files endpoint (upload_user_file() function fails to sanitize filename parameter), enabling arbitrary file write and remote code execution. CVSS 8.8. Disclosed by Tenable as advisory TRA-2026-26 on March 27, 2026.

All cves in this workspace.