CVE-2026-72762
7.7
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n8n-io | n8n | 0 < 1.123.67 | affected |
| n8n-io | n8n | 1.123.67 | unaffected |
| n8n-io | n8n | 0 < 2.32.1 | affected |
| n8n-io | n8n | 2.32.1 | unaffected |
| n8n-io | n8n | 0 < 2.31.5 | affected |
| n8n-io | n8n | 2.31.5 | unaffected |
Weaknesses
- CWE-434: Unrestricted Upload of File with Dangerous Type
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c
- https://www.vulncheck.com/advisories/n8n-before-arbitrary-file-write-via-edit-image-node
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.