Vulnerability intelligence
CVE-2026-5027
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
CVSS Score
8.8
High
EPSS — Exploit Probability
4.8%
Riskier than 92% of all CVEs · checked 2026-10-23
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
Unconfirmed
Check vendor advisories
3 articles across 3 outlets · first covered Jun 10, 2026 · latest Sep 30, 2026
Coverage timeline
RSS-
Google Warns N Day Flaws Are Driving a Surge in Exploitationcloud.google.com · Sep 30, 2026
-
Hackers Exploit Langflow Vulnerability for Remote Code Executionwww.securityweek.com · Jun 11, 2026
-
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCEthehackernews.com · Jun 10, 2026