Listen to this Post
The vulnerability exists in n8n’s webhook and form trigger nodes. When a workflow is triggered via a public form or webhook endpoint, it can execute code that includes file operations. An attacker can send a specially crafted HTTP POST request to a publicly accessible form endpoint. By manipulating form field values, the attacker can inject path traversal sequences (e.g., ‘../../’) into the parameters used by subsequent nodes in the workflow, such as the “Read/Write Files from Disk” node. If the workflow design uses unsanitized user input to construct file paths, the malicious payload can escape the intended directory. This allows the attacker to read arbitrary files from the server’s filesystem, such as `/etc/passwd` or application configuration files containing secrets, without requiring any authentication.
Platform: n8n
Version: < 1.121.0
Vulnerability: Path Traversal
Severity: Critical
date: 2026-01-07
Prediction: Patched 2026-01-07
What Undercode Say:
curl -X POST "https://target.com/form/<form-id>" -H "Content-Type: application/json" -d '{"fieldName":"../../../etc/passwd"}'
find / -name ".n8n" -type f 2>/dev/null | head -5
// Example vulnerable node configuration concept
const userSuppliedPath = $input.first().json.fieldName;
const fullPath = <code>/home/user/data/${userSuppliedPath}</code>;
return fs.readFileSync(fullPath);
How Exploit:
1. Discover public n8n form endpoints.
2. Analyze workflow field names via probing.
- Craft POST request with path traversal payload in form field.
4. Retrieve sensitive file contents from response.
Protection from this CVE
- Upgrade n8n to version 1.121.0+.
- Disable public form/webhook triggers if not required.
- Implement input validation/sanitization in custom nodes.
- Restrict filesystem permissions for the n8n process.
Impact:
- Unauthenticated Arbitrary File Read.
- Sensitive Information Disclosure.
- Potential System Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
