The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').
| Vendor | Product | Versions |
|---|---|---|
| langflow-ai | langflow | 0 |
Updated severity to CRITICAL and marked the vulnerability as actively exploited.
Initial creation
