n8n Arbitrary File Write Vulnerability (CVE-2026-72762) — High Severity

Understanding the n8n Arbitrary File Write Vulnerability

A serious security flaw, identified as CVE-2026-72762, has been discovered in n8n, a popular workflow automation tool. This vulnerability allows an authenticated attacker to write arbitrary files to the server where n8n is running. The issue stems from the “Edit Image” node within n8n, which doesn’t properly check the output format parameter before sending it to the underlying image processing library. This oversight can be exploited by a malicious user to craft a special format value, leading to unauthorized file creation outside the node’s designated working area.

CVE Details

• Product: n8n
• Published: August 11, 2026
• Severity: High
• Status: Analyzed

Affected Products

This vulnerability impacts specific versions of n8n. Users running the following versions are at risk:

• n8n versions prior to 1.123.67
• n8n versions prior to 2.31.5
• n8n versions prior to 2.32.1

Current Status

The vulnerability has been thoroughly analyzed. Details regarding the flaw and its potential impact are publicly available, and solutions have been released to address the problem.

Severity Level

The CVE-2026-72762 vulnerability is rated with a High severity score of 8.8 (CVSS). A “High” severity rating indicates that exploiting this vulnerability could have a significant negative impact on the confidentiality, integrity, or availability of the affected system. In this specific case, an attacker could write arbitrary files, which could lead to data corruption, system compromise, or even the execution of malicious code, posing a substantial risk to the n8n instance and potentially other connected systems.

Possible Solutions

The good news is that n8n has already released patches to fix this issue. Users are strongly advised to upgrade their n8n instances to one of the following versions or later to secure their systems:

• n8n version 1.123.67
• n8n version 2.31.5
• n8n version 2.32.1

If an immediate upgrade is not feasible, temporary mitigation steps can be taken, though these do not fully eliminate the risk and should only be considered short-term fixes:

• Restrict access to the n8n instance to only fully trusted users.
• Disable the “Edit Image” node by adding n8n-nodes-base.editImage to your NODES_EXCLUDE environment variable.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c
https://www.vulncheck.com/advisories/n8n-before-arbitrary-file-write-via-edit-image-node