What is CVE-2026-25056?

CVE-2026-25056 is a high-severity vulnerability in N8n, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-02-04.

How severe is CVE-2026-25056?

High severity. CVSS v3 base score is 8.8 out of 10.

Arbitrary file upload in N8n

CVE-2026-25056

n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's filesystem potentially leading to remote code execution. This issue has been patched in versions 1.118.0 and 2.4.0.

Vulnerability class: Unrestricted File Upload

EPSS: 0.007 (48.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

N8n
N8n-io N8n — versions < 1.118.0, < 2.4.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2026-25056?: CVE-2026-25056 is a high-severity vulnerability in N8n, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-02-04.
How severe is CVE-2026-25056?: High severity. CVSS v3 base score is 8.8 out of 10.