CVE-2026-72762 in n8n
Summary
by MITRE • 08/11/2026
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability under discussion affects n8n workflow automation platforms across multiple version lines including 1.123.67, 2.31.5, and 2.32.1, specifically within the Edit Image node functionality. This represents a critical arbitrary file write vulnerability that stems from insufficient input validation mechanisms within the image processing library integration. The flaw allows authenticated users with workflow execution privileges to manipulate the output format parameter in ways that bypass normal directory restrictions.
The technical implementation of this vulnerability resides in how the Edit Image node processes user-supplied format parameters without proper sanitization or validation checks. When users provide crafted format values, these parameters are directly passed to underlying image libraries that handle file creation operations. This design pattern creates an opportunity for path traversal attacks where malicious inputs can manipulate file system paths beyond the intended working directory boundaries. The vulnerability manifests as an improper input validation issue that aligns with CWE-22 Path Traversal and CWE-73 Path Traversal through directory traversal sequences.
From an operational impact perspective, this vulnerability enables authenticated attackers to write arbitrary files anywhere within the n8n instance file system, potentially leading to remote code execution, data exfiltration, or system compromise. The attack vector requires only workflow execution privileges, making it particularly dangerous in environments where multiple users have access to automation workflows. Attackers could leverage this capability to establish persistence mechanisms, install backdoors, or corrupt critical system files.
The security implications extend beyond simple file writing operations as they represent a fundamental failure in sandboxing and input validation within the workflow execution environment. This vulnerability directly impacts the principle of least privilege and can be exploited to escalate privileges within the n8n platform. Organizations running affected versions face potential exposure to both internal and external threats, particularly in multi-tenant environments where different users share the same automation infrastructure.
Mitigation strategies should focus on immediate patching of affected n8n versions to the latest releases that contain proper input validation for format parameters. Additionally, implementing network segmentation and access controls can help limit the scope of potential exploitation. Organizations should also consider restricting workflow execution privileges to minimize the attack surface and implement monitoring solutions to detect anomalous file system activity patterns. The remediation approach aligns with ATT&CK techniques related to privilege escalation and persistence mechanisms while addressing core security controls outlined in NIST SP 800-53 for secure software development practices.