Executive brief
n8n is a workflow automation platform that allows users to build and deploy automation workflows. When workflows accept uploaded files and transfer them to remote servers via SSH without proper validation, an attacker can write files to unintended locations on those remote systems, potentially leading to remote code execution. This requires the file upload endpoint to be unauthenticated and the attacker to know which workflows process files.
Technical details
The vulnerability is a path traversal / arbitrary file write issue (CWE-22) in n8n's SSH node that fails to validate file metadata when transferring uploaded files to remote systems. The SSH node does not properly sanitize file paths or validate that files are written to intended locations. An unauthenticated attacker can exploit this by uploading a file with a crafted path (e.g., containing directory traversal sequences) through an unauthenticated webhook endpoint that transfers the file via SSH to a remote server. This allows writing files to arbitrary locations on the remote system, potentially achieving remote code execution if the attacker writes to executable or configuration paths. The vulnerability affects n8n versions below 2.2.3 and has been patched in versions 2.4.0 and 1.123.12.
Affected products
- n8n n8n <2.2.3, fixed in 2.4.0 and 1.123.12
Timeline
- 2026-02-04: disclosed
- 2026-02-04: patched: Fixed in versions 2.4.0 and 1.123.12