Vulnerability intelligence
CVE-2026-5027
The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
CVSS Score
8.8
High
EPSS — Exploit Probability
31%
Riskier than 98% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
2 articles across 2 outlets · first covered Jun 10, 2026 · latest Jun 11, 2026
Tracked incidents
Coverage timeline
-
Hackers Exploit Langflow Vulnerability for Remote Code Executionwww.securityweek.com · Jun 11, 2026
-
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCEthehackernews.com · Jun 10, 2026