What is CVE-2026-25056?

CVE-2026-25056 is a high-severity vulnerability in N8n, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-02-04.

How severe is CVE-2026-25056?

High severity. CVSS v3 base score is 8.8 out of 10.

Arbitrary file upload in N8n

CVE-2026-25056

n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's filesystem potentially leading to remote code execution. This issue has been patched in versions 1.118.0 and 2.4.0.

Vulnerability class: Unrestricted File Upload

Published 2026-02-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.007 (50.9th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: +0.000

Affected products

N8n
N8n-Io N8n — versions < 1.118.0, < 2.4.0

Weakness classification (CWE)

References

github.com/n8n-io/n8n/security/advisories/GHSA-hv53-3329-vmrm (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2026-25056?: CVE-2026-25056 is a high-severity vulnerability in N8n, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-02-04.
How severe is CVE-2026-25056?: High severity. CVSS v3 base score is 8.8 out of 10.