Path Traversal in N8n
CVE-2026-56352
n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node's localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the REST API. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to bypass the N8N_RESTRICT_FILE_ACCESS_TO restriction and determine whether arbitrary files exist on the host; where the targeted path contains a valid workflow JSON file, that file can additionally be loaded and executed.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (24.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 24.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- N8n — versions 0, 2.19.3
Weakness classification (CWE)
References
- github.com/n8n-io/n8n/security/advisories/GHSA-2vx9-7wpg-88jq (vendor-advisory)
- www.vulncheck.com/advisories/n8n-arbitrary-file-read-and-execution-via-executew… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-56352?
- CVE-2026-56352 is a medium-severity vulnerability in N8n, classified under Path Traversal. CVSS score: 6.4/10. Published 2026-07-15.
- How severe is CVE-2026-56352?
- Medium severity. CVSS v3 base score is 6.4 out of 10.