EUVD-2026-67158
GHSA-q7m3-rhxg-7vxr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via exposed webhook; no attacker privileges required; scope changes because traversal reaches files outside the SQLite database boundary.
Primary rating from Vendor (https://github.com/DangerBlack/n8n-node-sqlite3).
CVSS VectorVendor: https://github.com/DangerBlack/n8n-node-sqlite3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Affected versions
< 1.0.0
Patched version
1.0.0
Description
In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the db_path field could allow an attacker to control which file was opened by SQLite, potentially enabling path traversal to read or overwrite arbitrary files accessible to the n8n process.
The vulnerability requires the workflow author to explicitly wire untrusted input to the db_path parameter, so it does not affect standalone deployments where only trusted users author workflows. However, in multi-tenant or user-facing n8n deployments the risk is elevated.
Fixed in v1.0.0 by moving the database path into a credential (v2 node architecture), which is stored server-side and not controllable by workflow input data.
References
- Fix commit: 145a887
- Introduced credential-based path: v2 node
Credits
dyingman1 (role: Reporter)
AnalysisAI
Path traversal in n8n-nodes-sqlite3 (all versions prior to 1.0.0) exposes multi-tenant n8n deployments to arbitrary file read and overwrite through the unsanitized db_path node parameter. When a workflow author explicitly maps untrusted end-user input to the SQLite node's database path field, an attacker can supply a crafted traversal string to redirect SQLite to open any file accessible to the n8n process-potentially exposing credentials, configuration files, or enabling data destruction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions: (1) n8n-nodes-sqlite3 must be at a version prior to 1.0.0, and (2) a workflow must be explicitly configured by its author to map untrusted external input-such as a webhook body field, form value, or API parameter-directly to the SQLite node's db_path parameter using an n8n expression. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS score or EPSS data was provided in the input; all severity signals are independently assessed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade n8n-nodes-sqlite3 to version 1.0.0, which is the vendor-confirmed patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today