Which versions of n8n are affected by EUVD-2026-56141?

n8n versions before 1.123.67 (1.x), 2.31.5 (2.x), and 2.32.1 (2.32.x) contain an arbitrary file-write vulnerability in the Edit Image node that allows workflow operators to access and modify files…. A patch is available.

How to fix or mitigate EUVD-2026-56141?

Within 24 hours: Identify all n8n deployments and versions, then restrict the Edit Image node to administrators only by modifying workflow access controls. Within 7 days: Upgrade all affected instances to patched versions (n8n 1.123.67 or later for 1.x, 2.31.5 or later for 2.x, 2.32.1 or later for 2.32.x). Within 30 days: audit workflow modifications and file system access logs from the past 90 days to identify potential exploitation, review and implement least-privilege controls for all workflow operators, and validate all instances run patched versions.

n8n EUVD-2026-56141

Q: What is the CVSS score of EUVD-2026-56141?

EUVD-2026-56141 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-72762 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-11 VulnCheck

GHSA-rwvr-8f8w-f6hc

File Upload N8n N8N Io

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network vector, low privilege required; scope change reflects writes escaping working directory to host paths; AC:H per CVSS 4.0 source and unspecified preconditions.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 13:17 EUVD

Source Code Evidence Fetched

Aug 11, 2026 - 12:48 vuln.today

Analysis Generated

Aug 11, 2026 - 12:48 vuln.today

CVE Published

Aug 11, 2026 - 12:17 cve.org

HIGH 7.7

DescriptionCVE.org

n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.

AnalysisAI

Arbitrary file write in n8n's Edit Image node allows authenticated workflow users to escape the node's designated working directory by injecting unsanitized format parameter values into the underlying image library. All n8n releases before 1.123.67 on the 1.x line, before 2.31.5 on the 2.x line, and before 2.32.1 on the 2.32.x line are affected, as confirmed by the GHSA-xmc9-4f2h-jf9c advisory from the n8n maintainers. No public exploit code has been identified at time of analysis, but patched versions and a remediation commit are available, and no special attacker position beyond workflow execution privileges is required.

Technical ContextAI

n8n is a Node.js-based workflow automation platform distributed via npm under the package name n8n (vendor n8n-io). The Edit Image node provides image manipulation capabilities and internally delegates processing to an underlying image library - likely Sharp, GraphicsMagick, or a similar native binding. The library accepts a format string to determine the output encoding and file destination, and n8n forwarded the caller-supplied format value to this library without sanitization or path restriction. This maps to CWE-434 (Unrestricted Upload of File with Dangerous Type), where the application trusts user-controlled input to determine the file type or write location without validation. By supplying a crafted format value - for example, one containing path traversal sequences or a library-specific directive that encodes an absolute path - an attacker can redirect the image library's file write operation to an arbitrary location accessible under n8n's process credentials. The CPE string cpe:2.3:a:n8n-io:n8n:* confirms the vulnerability covers the n8n application across all editions without platform restriction.

RemediationAI

The primary fix is to upgrade n8n to one of the three patched releases: 1.123.67 (1.x series), 2.31.5 (2.x series), or 2.32.1 (2.32.x series), all confirmed by the GHSA-xmc9-4f2h-jf9c advisory and the upstream patch commit at https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f. For operators unable to upgrade immediately, the vendor recommends two short-term mitigations, both of which carry trade-offs: first, restrict n8n instance access to fully trusted users only - this reduces exposure but does not eliminate the vulnerability if any authenticated user is considered a threat actor; second, disable the Edit Image node entirely by adding n8n-nodes-base.editImage to the NODES_EXCLUDE environment variable - this prevents exploitation of this specific vector but removes image editing capability from all workflows. The advisory explicitly states these workarounds do not fully remediate the risk and are intended only as temporary measures pending upgrade. Refer to the full advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c for the latest guidance.