The vulnerability originates in the build/server.cjs file of the update_node_from_file component in makafeli n8n-workflow-builder. A maliciously crafted filePath argument enables a path traversal attack that can read or expose arbitrary files on the host where the application runs. This flaw is a classic example of CWE‑22 and can compromise confidentiality when sensitive files are accessed.

The affected product is makafeli n8n-workflow-builder. All releases up to and including version 0.11.0 are vulnerable; later releases may contain a fix, but the vendor has not specified a concrete fixed version.

The CVSS base score of 4.8 indicates moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Because the attack vector is local, an adversary must have some foothold on the host or be able to run code through the application. Once the path traversal is achieved, reading files such as configuration, credentials, or logs can lead to significant local compromise.