| Titre | makafeli n8n-workflow-builder 0.11.0 Path Traversal |
|---|
| Description | A vulnerability was found in makafeli/n8n-workflow-builder 0.11.0. The issue affects the MCP tool update_node_from_file and the parameter filePath.
The update_node_from_file tool accepts a caller-controlled local filesystem path and reads it with fs.readFileSync(filePath, 'utf-8') without enforcing a trusted workspace, configured project directory, or user-approved path boundary. The resulting file content is then assigned to workflow.nodes[nodeIndex].parameters[parameterName] and persisted into the target n8n workflow through the n8n API.
An MCP client that can invoke this tool may cause the MCP server process to read arbitrary local text files accessible to the server user and store their contents inside an n8n workflow. The content can then be retrieved through the n8n workflow API or existing workflow read/export functionality. This may expose local configuration files, plaintext secrets, JSON credential files, source files containing embedded tokens, or other text-decodable files readable by the MCP server process.
This is not claimed to be an unauthenticated remote vulnerability in n8n itself. The issue is in the n8n-workflow-builder MCP server, which exposes an unrestricted local file read primitive and persists the read content into n8n.
Affected component: build/server.cjs
Affected tool: update_node_from_file
Affected parameter: filePath
Affected package version: 0.11.0
CWE: CWE-22 / CWE-200
CVSS v3.1: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Suggested severity: Medium
Suggested remediation: canonicalize and validate filePath before reading. Resolve the requested path with realpath and enforce containment within an operator-configured trusted workspace or project root. Reject absolute paths, traversal attempts, and symlink escapes that resolve outside the trusted root. Consider requiring explicit user approval for file imports from outside the workspace. |
|---|
| La source | ⚠️ https://github.com/makafeli/n8n-workflow-builder/issues/28 |
|---|
| Utilisateur | Mcfly_Zhang (UID 98877) |
|---|
| Soumission | 10/06/2026 02:06 (il y a 1 mois) |
|---|
| Modérer | 12/07/2026 13:35 (1 month later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 377850 [makafeli n8n-workflow-builder jusqu’à 0.11.0 update_node_from_file build/server.cjs filePath directory traversal] |
|---|
| Points | 20 |
|---|