CVE-2026-7524: Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution

Synopsis

A path traversal vulnerability (also called a Zip Slip or symlink-following flaw) affects IBM Langflow OSS versions 1.0.0 through 1.9.1, reachable over the network with no authentication required. An attacker can craft a malicious archive file containing symbolic links that escape their intended extraction directory, writing arbitrary files to the host filesystem. Successful exploitation grants full remote code execution, allowing the attacker to read, modify, or delete data and execute arbitrary commands on the affected host. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment IBM publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, meaning an attacker can reach it from any internet-accessible host without requiring LAN or VPN access (AV:N).

• AuthenticationNot required

  No account or credential of any kind is needed to trigger the vulnerability; an unauthenticated attacker can send a crafted request directly (PR:N).

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from a user or administrator on the target system (UI:N).

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or environmental configuration to succeed (AC:L).

Blast Radius

• Reads arbitrary files from the host filesystem, including application secrets, credentials, and private keys stored outside the application directory.
• Writes attacker-controlled files to arbitrary filesystem paths, enabling web shell placement or overwriting of application binaries and configuration files.
• Executes arbitrary commands on the host with the privileges of the Langflow OSS process, giving the attacker full control over the container or underlying node.
• Disrupts service availability by overwriting critical runtime files or consuming disk resources, causing the affected service to crash or become unresponsive.