What is GHSA-7xr9-m7x2-5wqq?

GHSA-7xr9-m7x2-5wqq is a security advisory published by GitHub Security Advisories with Medium severity. IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API ...

Which CVE IDs does GHSA-7xr9-m7x2-5wqq cover?

GHSA-7xr9-m7x2-5wqq covers the following CVE IDs: CVE-2026-7869. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7xr9-m7x2-5wqq?

GHSA-7xr9-m7x2-5wqq has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-7xr9-m7x2-5wqqMediumCVSS 5.4

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API ...

Vendor

GitHub Security Advisories

Published

August 5, 2026

Last Modified

August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-7869 →

📋 Description

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-7869
https://www.ibm.com/support/pages/node/7282647
https://github.com/advisories/GHSA-7xr9-m7x2-5wqq