TLDR Tech / InfoSec
Path Traversal Flaw in AI Dev Platform Langflow Exploited in Attacks (2 minute read)
Security researchers warn that a path traversal vulnerability in Langflow, disclosed in March, is now being exploited by attackers. The vulnerability stems from the POST /api/v2/files endpoint not properly sanitizing paths, allowing attackers to upload arbitrary files to Langflow servers. Langflow enables unauthenticated, auto-login by default, meaning that this vulnerability can be exploited by unauthenticated attackers in default configurations.
Read the full story