Junglewise Threat Intelligence

n8n path traversal bypass in Git node fetch and pull operations

Severity: high · CVSS 7.1 · Published 2026-07-22

Technologies: N8n. Vendors: N8n.

Executive brief

n8n is a popular workflow automation tool used to connect various business applications. A security flaw in its Git integration allows authorized users to bypass folder restrictions and access sensitive files or code history from the server's local storage that should be off-limits. This could lead to the exposure of proprietary code, configuration files, or other sensitive data stored on the host system.

Technical details

A path traversal vulnerability (CWE-22) exists in the Git node of n8n. While 'clone' and 'push' operations were previously protected by repository-path containment checks, the 'fetch', 'pull', and 'push-tags' operations lacked similar enforcement. An authenticated attacker with workflow creation or execution privileges can provide a local file path as a remote configuration value. This allows the attacker to pull an arbitrary local git repository from the host filesystem into the n8n workspace, enabling them to read the repository's files and commit history. The issue is fixed in versions 1.123.67, 2.31.5, and 2.32.1.

Affected products

  • n8n-io n8n < 1.123.67, >= 2.0.0-rc.0 < 2.31.5, >= 2.32.0 < 2.32.1

Timeline

  • 2026-07-22: disclosed
  • 2026-07-22: patched
  • 2026-07-22: advisory

References

Related threats