N8n
CVE-2026-25055
HIGH
GHSA-m82q-59gv-mcr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify unauthenticated file upload endpoint
-
DeliveryUpload malicious file with crafted metadata
-
ExploitSSH node transfers file to unvalidated path
-
ExecutionFile written to sensitive directory
-
ImpactRemote code execution achieved
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | n8n workflow must exist that: (1) accepts unauthenticated file uploads, (2) uses SSH node to transfer files to remote servers, and (3) does not validate file metadata or destination paths. Attacker must discover such vulnerable workflow endpoints. |
| Impact | CVSS 8.1 (HIGH). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: None. Exploitation no authentication required. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker without authentication could exploit this vulnerability to files being written to unintended locations on those remote systems potentially. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
n8n is an open source workflow automation platform. [CVSS 8.1 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-22 (Path Traversal). Affects N8N. n8n is an open source workflow automation platform. Prior to versions 1.123.12 and 2.4.0, when workflows process uploaded files and transfer them to remote servers via the SSH node without validating their metadata the vulnerability can lead to files being written to unintended locations on those remote systems potentially leading to remote code execution on those systems. As a prerequisites an unauthenticated attacker needs knowledge of such workflows existing and the endpoints for file uploads
Know when N8n gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
n8n is an open source workflow automation platform. Prior to versions 1.123.12 and 2.4.0, when workflows process uploaded files and transfer them to remote servers via the SSH node without validating their metadata the vulnerability can lead to files being written to unintended locations on those remote systems potentially leading to remote code execution on those systems. As a prerequisites an unauthenticated attacker needs knowledge of such workflows existing and the endpoints for file uploads need to be unauthenticated. This issue has been patched in versions 1.123.12 and 2.4.0.
Executive ViewAI
A HIGH severity vulnerability (CVSS 8.1) has been identified in n8n, an open source workflow automation platform used in your environment. This vulnerability could allow unauthorized access or manipulation of automated workflows, potentially impacting business processes that depend on n8n for data integration and task automation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
Authenticated users who can create or modify an n8n workflow can achieve remote code execution on the n8n host by abusin
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
Exploit-DB