CVE-2025-68478 json
Langflow Vulnerable to External Control of File Name or Path
published 10mo ago modified 27d ago also EUVD-2025-204581 , GHSA-f43r-cc68-gpx4 , PYSEC-2025-125
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.8%
- EPSS 5.8% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is. Version 1.7.0 fixes the issue.
Patch / fix
- pypi langflow 1.7.0, 1.7.1
- langflow langflow 1.7.0
- langflow-ai langflow 1.7.0
Is CVE-2025-68478 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10mo ago
Exploit prediction
5.79% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/langflow-ai/langflow/security/advisories/GHSA-f43r-cc68-gpx4 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
| OSV | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | langflow | <1.7.1 <1.7.0 |
1.7.1 1.7.0 |
Affected products
- langflow-ai langflow
Classification
References
-
github.com
/langflow-ai/langflow/security/advisories/GHSA-f43r-cc68-gpx4
exploit, web, vendor-advisory, evidence
-
nvd.nist.gov
/vuln/detail/CVE-2025-68478
advisory
-
github.com
/langflow-ai/langflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2025-125.yaml
web
Sources
- CVE List CVE-2025-68478
- GitHub Advisory GHSA-f43r-cc68-gpx4
- NVD CVE-2025-68478
- OSV PYSEC-2025-125
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.