CVE-2025-68478

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is. Version 1.7.0 fixes the issue.

An adversary with a shared dev team Langflow account (or stolen low-privilege credentials) sends a POST request to the Flow save endpoint with `fs_path` set to `/etc/cron.d/persistence`. The Langflow server serializes a Flow JSON object — whose content can be partially controlled — to that path. If the JSON structure includes a comment-like line parseable as a valid cron expression, cron executes it on the next run interval. Alternatively, writing to `/home/ubuntu/.ssh/authorized_keys` injects an attacker SSH public key for persistent access. In an AI pipeline context, the attacker overwrites a scheduled Python training script at `/opt/ml/scripts/train.py` with a reverse shell payload, which executes when the next training run triggers, granting access to model weights, API keys stored as environment variables, and the full data science infrastructure.