EUVD-2026-56099
GHSA-cgh8-xfc3-8rm5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required login; AC:H maps the AT:P condition that computer-use workflows must be deployed and actor controls search input; S:C for sandbox boundary breach; C:H for arbitrary host file read; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.
AnalysisAI
Path traversal in n8n's @n8n/computer-use search_files tool exposes arbitrary local files to any actor who can control the tool's search input. Affected versions span all n8n releases before 2.31.5 and the entire 2.32.x branch before 2.32.1, limited to deployments that run AI agent workflows leveraging the computer-use package. An authenticated low-privileged user can bypass the configured base-directory sandbox and retrieve the names and contents of any file readable by the n8n daemon's OS user account. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Technical ContextAI
n8n is a Node.js-based workflow automation platform distributed via npm (CPE: cpe:2.3:a:n8n-io:n8n). The vulnerable component is the @n8n/computer-use package's file-search (search_files) tool, which is invoked from within AI agent workflows. The tool is designed to confine file-system queries to an operator-configured base directory acting as a security sandbox. The root cause is CWE-22 (Path Traversal): the confinement check fails to canonicalize or validate search patterns before applying access-control decisions, allowing crafted inputs - such as glob expressions with relative traversal components - to expand to paths outside the permitted tree. Because the sandbox escape is at the OS level, the breadth of disclosure is bounded only by the read permissions of the n8n daemon's process account, potentially exposing environment files, application secrets, host credentials, or other sensitive configuration on the underlying host.
RemediationAI
Vendor-released patches are confirmed by the GitHub GHSA advisory (GHSA-pf2q-pxhf-hgmw): upgrade n8n to version 2.31.5 on the stable branch or 2.32.1 on the 2.32.x branch. Both fix versions are independently confirmed via GHSA npm package vulnerability data and represent the primary remediation. For deployments where immediate upgrade is not feasible, the vendor recommends three temporary mitigations. First, restrict n8n instance access to fully trusted users only - this reduces but does not eliminate risk in multi-user environments and has no technical side effects. Second, disable or remove all AI agent workflows that invoke the @n8n/computer-use package; this directly eliminates the vulnerable attack surface and is the most effective short-term control, with the trade-off of losing AI computer-use functionality. Third, ensure the n8n process runs under a dedicated low-privilege OS user account with minimal read access - avoiding access to paths such as /etc, /root, or application credential directories - which narrows the blast radius of exploitation without removing functionality. None of these workarounds fully remediate the underlying path traversal flaw and the vendor explicitly notes they are short-term measures only.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today