EUVD-2026-42893
GHSA-2vww-6p9h-5g8j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and low-complexity; low privileges required; disk exhaustion rated High as it can fully impact host availability beyond n8n alone.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
AnalysisAI
Disk space exhaustion in n8n's data-table file upload endpoint allows an authenticated user to progressively fill the host's disk by repeatedly uploading files whose cumulative size is never checked against what already exists in the shared temporary directory. Affected versions span all n8n releases before 2.28.0 on the 2.x branch and before 1.123.58 on the 1.x branch. The flaw is rooted in a stateless per-request quota that ignores previously written files, enabling a low-privileged user to loop uploads between periodic cleanup cycles until disk space is exhausted, potentially disrupting the host and all co-resident services. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
n8n is an open-source, self-hostable workflow automation platform (CPE: cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*). Its data-table feature exposes a file upload endpoint that writes incoming files to a shared temporary directory on the host filesystem. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the per-request quota enforcement checks only the size of the file in the current request, never aggregating or querying the running total of files already present in the shared temp directory from prior requests. Because the temporary directory is shared across all users and requests and cleanup is periodic rather than immediate, an authenticated user can issue rapid successive upload requests, each individually within quota, while the cumulative on-disk footprint grows unboundedly until the next cleanup cycle. This is a classic TOCTOU-adjacent resource exhaustion pattern in upload handling.
RemediationAI
Upgrade n8n to version 2.28.0 or later on the 2.x branch, or to version 1.123.58 or later on the 1.x branch; these are the vendor-released fixed versions per the GitHub Security Advisory GHSA-w867-jm58-p9pv (https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv). If an immediate upgrade is not possible, reduce the period between temporary directory cleanup cycles to limit the accumulation window - the trade-off is increased I/O overhead from more frequent cleanup. Operators can also restrict file upload access at the reverse proxy or network layer to a limited set of trusted user IP ranges, accepting the trade-off of reduced accessibility. Enforcing per-user or per-session disk quotas at the OS level (e.g., via tmpfs with a size limit for the temp directory) provides an independent compensating control that caps blast radius even if the application-level check is bypassed; the trade-off is that a full tmpfs may cause upload failures for legitimate users. Disabling the data-table file upload feature entirely is the most effective workaround if the feature is not operationally required.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
The n8n package 0.218.0 for Node.js allows Directory Traversal. Rated medium severity (CVSS 6.5), this vulnerability is
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allow
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callbac
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary c
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today