CVE-2025-68478: 
Homebrew vulnerability analysis and mitigation

CVE-2025-68478 is an External Control of File Name or Path vulnerability in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, the fs_path parameter in the flow creation API endpoint accepts arbitrary file system paths without restriction, normalization, or allowed-directory enforcement, enabling authenticated attackers to write or overwrite files anywhere on the server. The vulnerability was published on December 19, 2025, and affects all Langflow versions below 1.7.0 (patched in 1.7.1 per the GitHub Advisory Database). It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Langflow Advisory).

The root cause is CWE-73 (External Control of File Name or Path) and CWE-610 (Externally Controlled Reference to a Resource in Another Sphere). The vulnerable code resides in langflow/src/backend/base/langflow/api/v1/flows.py: the _verify_fs_path() function accepts the caller-supplied fs_path value, constructs a Path object directly from it, and creates the file if it does not exist — with no path restriction or normalization. Subsequently, _save_flow_to_fs() opens the resolved path in write mode ("w") and serializes the Flow object as JSON, overwriting any existing file. Because the endpoint requires only a valid API key or JWT (low-privilege authenticated access), any authenticated user can supply an absolute path such as /etc/cron.d/backdoor or /tmp/POC.txt and have Flow JSON written there (Langflow Advisory, GitHub Advisory).

Successful exploitation allows an authenticated attacker with low privileges to create or overwrite arbitrary files on the server within the permission scope of the Langflow process. This poses a high integrity risk: critical configuration files, cron jobs, application scripts, or log files can be corrupted or replaced with attacker-controlled JSON content. If the Langflow service runs as root or with elevated permissions, the impact extends to system-level files, potentially enabling privilege escalation or persistent access. Availability is also affected if essential system or application files are overwritten, causing service disruption (Langflow Advisory).

A public proof-of-concept (PoC) is available in the GitHub Security Advisory, demonstrating exploitation via a simple curl command targeting the /api/v1/flows/ endpoint with a crafted fs_path value. As of the time of disclosure, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.034% (0.000390 per Feedly data), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access (low-privilege credentials or a valid API key), limiting opportunistic mass exploitation but not insider or post-compromise scenarios (GitHub Advisory, Langflow Advisory).

1. Obtain credentials: Acquire a valid Langflow API key or JWT token — either through legitimate low-privilege account access, credential theft, or brute force against exposed instances.
2. Identify target path: Determine a high-value file to overwrite or create (e.g., /etc/cron.d/backdoor, /root/.ssh/authorized_keys, or application config files), considering the permissions of the Langflow process.
3. Craft malicious request: Construct a POST request to /api/v1/flows/ with the fs_path field set to the desired absolute path and a minimal valid flow payload:

curl -sS -X POST "http://<target>:7860/api/v1/flows/" \
  -H "Content-Type: application/json" \
  -H "x-api-key: <API_KEY>" \
  -d '{"name":"poc","data":{"nodes":[],"edges":[]},"fs_path":"/etc/cron.d/backdoor"}'

4. File written: The server serializes the Flow object as JSON and writes it to the specified path, creating or overwriting the target file.
5. Achieve objective: Depending on the target file, the attacker may achieve persistence (e.g., cron-based command execution), configuration tampering, or disruption of dependent services that parse the overwritten file (Langflow Advisory).

• Network: Unexpected POST requests to /api/v1/flows/ containing a fs_path field with absolute paths (e.g., /etc/, /root/, /var/, /tmp/) in the request body; API calls from unusual source IPs or at unusual times.
• Logs: Langflow application logs showing flow creation events with non-standard fs_path values; OS-level audit logs (e.g., auditd) recording file creation or modification events in sensitive directories by the Langflow process.
• File System: Unexpected JSON-formatted files appearing in system directories (e.g., /etc/, /tmp/, /var/spool/cron/); modification timestamps on configuration or cron files coinciding with Langflow API activity.
• Process: Langflow worker process (uvicorn, python) performing file writes outside its expected working directory or designated flow storage path (Langflow Advisory).

Upgrade Langflow to version 1.7.1 or later, which resolves the issue by enforcing path restrictions and validation on the fs_path parameter (the GitHub Advisory Database notes 1.7.1 as the patched version, while the original advisory referenced 1.7.0). As interim mitigations: restrict network access to Langflow instances to trusted users only; enforce the principle of least privilege by running the Langflow service as a non-root user with minimal file system permissions; and monitor file system changes in sensitive directories for unexpected JSON file creation. Implement proper access controls to limit API key issuance to authorized personnel (GitHub Advisory, Langflow Advisory).