Executive brief
n8n is a workflow automation platform with AI capabilities used to orchestrate business processes and integrations. A flaw in the file-search tool of the computer-use component allows attackers to read arbitrary files on the server outside the intended sandbox directory, potentially exposing sensitive configuration files, credentials, and data accessible to the application's system account.
Technical details
A path-confinement bypass vulnerability (CWE-22) exists in the @n8n/computer-use file-search tool. The component was designed to restrict searches to a configured base directory, but a crafted search pattern can bypass this confinement check and expand to locations outside that directory. An attacker who can influence the search input—typically through AI agent workflows or API calls—can retrieve file names and contents from anywhere on the filesystem readable by the n8n daemon's OS user. The vulnerability affects all versions prior to 2.31.5 and 2.32.0 through 2.32.0; it has been patched in versions 2.31.5 and 2.32.1 or later. Network access and low privileges (authenticated user) are required to exploit this issue.
Affected products
- n8n n8n < 2.31.5 and 2.32.0
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: Fixed in versions 2.31.5 and 2.32.1