Executive brief
n8n is a workflow automation tool used to connect different software services and automate business processes. A vulnerability in the ExecuteWorkflow component allows authorized users to bypass security restrictions and access files on the server that should be off-limits. This could allow an attacker to confirm the existence of sensitive files or execute unauthorized workflows that trigger actions in connected business systems.
Technical details
A path traversal vulnerability (CWE-22) exists in the ExecuteWorkflow node's localFile source option. While this option is hidden in the UI, it remains accessible via the REST API and fails to enforce the N8N_RESTRICT_FILE_ACCESS_TO environment variable. An authenticated attacker with workflow creation or modification permissions can provide arbitrary file paths to determine file existence on the host. If the targeted path contains a valid workflow JSON file, the attacker can load and execute it, potentially impacting downstream systems. The issue is resolved in versions 2.19.3 and 2.20.0.
Affected products
- n8n-io n8n < 2.19.3
Timeline
- 2026-05-13: disclosed: Initial disclosure by reporter
- 2026-05-19: advisory: GitHub Advisory published
- 2026-05-19: patched: Fix confirmed in versions 2.19.3 and 2.20.0