{
 "id": "AIR-2026-1193",
 "slug": "cve-2026-8859-ibm-langflow-oss-path-traversal-allows-arbitra",
 "title": "CVE-2026-8859: IBM Langflow OSS path traversal allows arbitrary file write",
 "summary": "A path traversal vulnerability in IBM Langflow OSS allows an attacker controlling an external HTTP server to write arbitrary files to unintended locations via the APIRequest component. The flaw stems from unsanitized filenames in HTTP response headers.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Langflow"
 ],
 "incident_date": "2026-07-17",
 "incident_date_precision": "day",
 "first_reported": "2026-07-17",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8859",
   "publisher": "NVD",
   "title": "CVE-2026-8859: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to…",
   "published_at": "2026-07-17"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-8859",
  "langflow",
  "path-traversal"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}