# CVE-2026-5027: Path Traversal Arbitrary File Write in Langflow AI Dev Platform (upload_user_file) Exploited in the Wild for Unauthenticated RCE

> CVE-2026-5027 is a path traversal flaw (CWE-22, CVSS 8.8) in Langflow's POST /api/v2/files upload endpoint: the upload_user_file() handler passes the multipart filename straight to the storage service without sanitization, so '../' sequences let an attacker write files anywhere on disk. Because Langflow ships with unauthenticated auto-login by default, the endpoint is reachable without credentials, turning arbitrary file write into unauthenticated remote code execution via cron, SSH authorized_keys, or webshell. Tenable disclosed it on 2026-03-27 (TRA-2026-26); it is now actively exploited against publicly exposed instances per VulnCheck honeypot data.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0766
- **ID:** TL-2026-0766
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-5027

## Description

CVE-2026-5027 is an arbitrary file write vulnerability in Langflow, a popular open-source visual framework for building LLM/agent pipelines. The defect lives in the v2 file-upload API. In src/backend/base/langflow/api/v2/files.py, the upload_user_file() function takes the 'filename' field from the multipart/form-data request and passes file.filename directly to the storage service without normalizing or validating the path. An attacker who supplies a filename containing path-traversal sequences ('../../../') can therefore break out of the intended per-user upload directory and write the uploaded bytes to any location the Langflow process can reach on the host filesystem.

The vulnerability is classified CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). Tenable scored it CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS v4 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Although the base vector lists PR:L (low privileges), the practical authentication requirement collapses to none: Langflow enables unauthenticated 'auto-login' by default, so a single unauthenticated HTTP request yields a valid session token, after which the file-write endpoint is fully reachable. The result is unauthenticated remote code execution.

Arbitrary file write is escalated to code execution through several well-known primitives: writing a crontab entry into the cron spool (e.g. /etc/cron.d/ or a user crontab) to run an attacker command as root on the next schedule tick; appending an attacker public key to ~/.ssh/authorized_keys to gain interactive SSH access; or dropping a webshell into a web-served directory. The public proof-of-concept (GitHub: yahiahamza/CVE-2026-5027) automates a basic file-write test, an authenticated mode, and a reverse-shell payload (default port 4444), confirming low exploitation complexity.

The flaw affects Langflow application releases up to and including 1.8.4 (i.e. < 1.9.0) and the langflow-base package < 0.8.3. It was remediated in Langflow 1.9.0 / langflow-base 0.8.3 (2026-03-30); users are advised to move to 1.10.0 (released 2026-06-10). Tenable researcher Joshua Martinelle attempted coordinated disclosure with three contact attempts in January-February 2026 and a final notice on 2026-03-23 before publishing advisory TRA-2026-26 on 2026-03-27 with no vendor fix available at publication.

Exploitation in the wild was observed by VulnCheck honeypots. Within roughly 48 hours of the advisory, six unique source IPs probed honeypot instances; four of them arrived within minutes of each other delivering an identical payload, consistent with automated, opportunistic scanning. The most advanced activity came from 173.212.205.251, which staged a second-stage dropper at http://173.212.205.251:8443/z and ran a thorough credential-harvesting routine, including dumping the full process environment — which in a typical Langflow deployment exposes database connection strings, API keys, and cloud credentials. Censys data shows roughly 7,000 publicly exposed Langflow instances (default service port 7860), the majority in North America, defining a large opportunistic attack surface. CVE-2026-5027 belongs to a cluster of 2026 Langflow vulnerabilities under active attack alongside CVE-2025-34291 (origin-validation RCE, CVSS 9.4, added to CISA KEV and weaponized by MuddyWater), CVE-2026-33017 (unauthenticated RCE exploited within ~20 hours, used to steal AWS keys and deploy a NATS worker), CVE-2026-0770, and CVE-2026-21445.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1608 Stage Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1053 Scheduled Task/Job
- T1098 Account Manipulation
- T1505 Server Software Component
- T1053 Scheduled Task/Job
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel

## Sources

- [Langflow - Path Traversal Arbitrary File Write via upload_user_file (TRA-2026-26)](https://www.tenable.com/security/research/tra-2026-26)
- [CVE-2026-5027 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-5027)
- [Path traversal flaw in AI dev platform Langflow exploited in attacks](https://www.bleepingcomputer.com/news/security/path-traversal-flaw-in-ai-dev-platform-langflow-exploited-in-attacks/)
- [Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE](https://thehackernews.com/2026/06/unpatched-langflow-flaw-cve-2026-5027.html)
- [Directory Traversal in langflow-base | CVE-2026-5027 | Snyk](https://security.snyk.io/vuln/SNYK-PYTHON-LANGFLOWBASE-15842030)
- [Security Bulletin: Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint](https://www.ibm.com/support/pages/node/7271094)
- [CVE-2026-5027 - Langflow Path Traversal to Remote Code Execution (PoC)](https://github.com/yahiahamza/CVE-2026-5027)
- [CVE-2026-5027 langflow-ai langflow Multipart Form Data files (VulDB)](https://vuldb.com/vuln/353945)
- [CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV](https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0766