CVE-2026-110244

MediumCVSS 6.5/10Last modified Oct 30, 2026

Description

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
IBM	Langflow OSS	>= 1.0.0, <= 1.12.4

References

https://www.ibm.com/support/pages/node/7293016Patch, Vendor Advisory

Timeline

Published: Oct 29, 2026
Last modified: Oct 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1102457.5IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.CVE-2026-1102478.4Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message th CVE-2026-1102485.3Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 bef CVE-2026-1102498.6A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough CVE-2026-110256.5Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass content CVE-2026-1102515.4The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and CVE-2026-1102525.4The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This CVE-2026-1102535.4The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to i CVE-2026-1102544.3Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety CVE-2026-1102558.5Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to ma CVE-2026-1102563.7Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts CVE-2026-1102575.5OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an i