EUVD-2026-43261
GHSA-pjp8-f5mg-f25p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack requiring low-privilege access to invoke the file endpoint; unchanged scope and partial C/I/A reflect limited traversal impact bounded by process permissions.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update_node_from_file. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in makafeli n8n-workflow-builder (versions up to 0.11.0) allows a local low-privileged attacker to manipulate the filePath argument in the update_node_from_file function within build/server.cjs, enabling arbitrary file reads and writes outside the intended directory scope. A publicly available proof-of-concept exists on GitHub (issue #28), and the vendor has not responded to the coordinated disclosure. No public exploit has been confirmed as actively exploited and it is not listed in CISA KEV, but the local requirement combined with POC availability makes this a credible insider or post-compromise risk.
Technical ContextAI
The affected product is makafeli n8n-workflow-builder, a community-authored extension for the n8n workflow automation platform. The vulnerability resides in build/server.cjs, specifically in the update_node_from_file component, which appears to accept a user-controlled filePath argument for server-side file operations. CWE-22 (Path Traversal) describes the root cause: the application fails to canonicalize or validate the filePath value before using it in a filesystem operation, permitting an attacker to inject directory traversal sequences (e.g., ../../) to escape the intended working directory. The CPE cpe:2.3:a:makafeli:n8n-workflow-builder:*:*:*:*:*:*:*:* confirms the scope is limited to this specific package across all releases up to 0.11.0. Because this is a Node.js CommonJS bundle (server.cjs), the path handling bug is entirely server-side and does not require a browser or client-side interaction.
RemediationAI
No vendor-released patch identified at time of analysis - the maintainer has not responded to the disclosure reported via GitHub issue #28 (https://github.com/makafeli/n8n-workflow-builder/issues/28). As an immediate compensating control, restrict OS-level access to the server running n8n-workflow-builder so that only fully trusted accounts can interact with it, eliminating the low-privilege local attacker scenario. If the update_node_from_file functionality is not required in your deployment, consider disabling or removing that code path from the installed build/server.cjs manually, though this is fragile and will be reverted on upgrade. Additionally, run the n8n-workflow-builder server process under a dedicated, least-privilege service account with minimal filesystem permissions to reduce the blast radius of a successful traversal. Monitor GitHub https://github.com/makafeli/n8n-workflow-builder/ for a patched release and apply it immediately when available. Organizations with no operational dependency on this package should consider uninstalling it until a maintained patch is released.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today