Langflow Path Traversal Vulnerability Allowing Arbitrary File Write

A path traversal vulnerability has been identified in Langflow's 'POST /api/v2/files' endpoint. The issue arises because the endpoint does not properly sanitize the 'filename' parameter in the multipart form data. This lack of validation enables attackers to use path traversal sequences to write files to arbitrary locations on the filesystem.

Impact

Exploitation of this vulnerability could lead to unauthorized file writing on the server, potentially overwriting critical files or allowing the execution of malicious scripts, depending on the file type and location.