Listen to this Post
How CVE-2026-54687 Works
This vulnerability resides in the `n8n-nodes-sqlite3` package, which is used to add a SQLite node to n8n workflows. In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter, which was visible and editable within the workflow itself.
The core of the issue is that a workflow author could map untrusted user input to the `db_path` field. If an attacker could control this input, they could manipulate the file path that SQLite would attempt to open. This creates a classic path traversal vulnerability.
By using relative path sequences (like ../), an attacker could force the n8n process to access files outside of the intended directory. This could allow them to read sensitive files, such as configuration files or the internal SQLite database itself, which may contain encryption secrets. In a worst-case scenario, if the n8n process has write permissions, an attacker might also be able to overwrite arbitrary files.
It’s important to note that this vulnerability requires the workflow author to explicitly connect untrusted user input to the `db_path` parameter. This means that standalone deployments where only trusted users create workflows are not affected. However, the risk is significantly higher in multi-tenant or user-facing n8n deployments where untrusted users can author workflows.
The vulnerability was fixed in version 1.0.0. The fix involved moving the database path into a credential as part of the v2 node architecture. This credential is stored server-side and is not controllable by workflow input data, effectively eliminating the attack vector.
DailyCVE Form:
Platform: n8n-nodes-sqlite3
Version: < 1.0.0
Vulnerability: Path Traversal
Severity: Medium
date: August 27, 2026
Prediction: Already Patched (v1.0.0)
What Undercode Say:
The vulnerability is triggered when a workflow author exposes the `db_path` parameter to user input.
Analytics:
To check if your instance is vulnerable, you can inspect the workflow JSON for the SQLite node.
Check for the presence of the db_path parameter in a workflow export cat workflow.json | grep -i "db_path" Check the installed version of the n8n-nodes-sqlite3 package npm list n8n-nodes-sqlite3
Exploit: (Educational Purposes!)
An attacker could attempt to read the n8n configuration file by manipulating the `db_path` parameter.
Example of a malicious path traversal payload db_path = "../../../.n8n/config"
By setting the database path to a sensitive file, the SQLite node would attempt to open it, potentially exposing its contents in an error message or workflow output.
Protection:
- Immediate Action: Upgrade the `n8n-nodes-sqlite3` package to version `1.0.0` or later immediately.
- Long-term Strategy: In multi-tenant environments, restrict workflow creation privileges to only trusted users.
- Best Practice: Avoid directly mapping user input to file system paths in any node. Utilize n8n’s credential system for sensitive parameters like file paths.
Impact:
- Confidentiality: An attacker could read arbitrary files accessible to the n8n process, including configuration files and internal databases containing secrets.
- Integrity: If the n8n process has write permissions, an attacker could potentially overwrite critical files, leading to a denial of service or further compromise.
- Availability: The vulnerability could be used to corrupt or delete the SQLite database used by n8n, causing the application to fail.
- Attack Vector: Requires a workflow author to wire untrusted input to the `db_path` parameter, making it more likely to be exploited in multi-tenant environments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
