{"id":"CVE-2026-5027","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-5027","generatedAt":"2026-10-31T05:59:16.909Z","title":"The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').","description":"The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').","published":"2026-03-27T15:17:05.000Z","lastModified":"2026-08-18T18:00:03.000Z","status":"Analyzed","sourceIdentifier":"vulnreport@tenable.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-22"],"affected":["langflow/langflow"],"epss":{"score":0.39973,"percentile":0.98627,"date":"2026-10-30","history":[{"date":"2026-09-24","score":0.04758,"percentile":0.91549},{"date":"2026-10-25","score":0.39973,"percentile":0.98619}]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2026-08-31","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":52659,"kind":"exploit","title":"Langflow  1.8.4 - Path Traversal to Remote Code Execution","url":"https://www.exploit-db.com/exploits/52659","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52659.py","file":"exploits/multiple/webapps/52659.py","published":"2026-08-31","added":"2026-08-31","updated":"2026-08-31","author":"cardosource","type":"webapps","platform":"multiple","port":null,"verified":false,"codes":["CVE-2026-5027"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 40.0%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-10-25T00:00:00.000Z","detail":{"to":0.39973,"from":0.04758,"percentile":0.98619},"summary":"EPSS moved from 4.8% to 40.0% probability of exploitation in the next thirty days."},{"kind":"epss","label":"EPSS jump","at":"2026-09-24T00:00:00.000Z","detail":{"to":0.04758,"from":0.36141,"percentile":0.91549},"summary":"EPSS moved from 36.1% to 4.8% probability of exploitation in the next thirty days."},{"kind":"exploit","label":"Public exploit","at":"2026-08-31T00:00:00.000Z","detail":{"type":"webapps","edbId":52659,"title":"Langflow  1.8.4 - Path Traversal to Remote Code Execution","platform":"multiple","verified":false,"publishedAt":"2026-08-31"},"summary":"Public exploit published in Exploit-DB: Langflow  1.8.4 - Path Traversal to Remote Code Execution (webapps, multiple)."}],"references":[{"url":"https://www.tenable.com/security/research/tra-2026-26","tags":["Vendor Advisory","Third Party Advisory"],"source":"vulnreport@tenable.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-5027","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}