CVE-2026-72762

Published: Ago 11, 2026 Last Modified: Ago 11, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.

434

Unrestricted Upload of File with Dangerous Type

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
Languages: ASP.NET, PHP, Not Language-Specific
Technologies: Web Server, AI/ML
Likelihood of Exploit: Medium
View CWE Details
https://github.com/n8n-io/n8n/security/advisories/GHSA-xmc9…
https://github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c
https://www.vulncheck.com/advisories/n8n-before-arbitrary-f…
https://www.vulncheck.com/advisories/n8n-before-arbitrary-file-write-via-edit-i…