CVE-2026-15521

makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update_node_from_file. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The vulnerability originates in the build/server.cjs file of the update_node_from_file component in makafeli n8n-workflow-builder. A maliciously crafted filePath argument enables a path traversal attack that can read or expose arbitrary files on the host where the application runs. This flaw is a classic example of CWE‑22 and can compromise confidentiality when sensitive files are accessed.

Affected Systems

The affected product is makafeli n8n-workflow-builder. All releases up to and including version 0.11.0 are vulnerable; later releases may contain a fix, but the vendor has not specified a concrete fixed version.

Risk and Exploitability

The CVSS base score of 4.8 indicates moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Because the attack vector is local, an adversary must have some foothold on the host or be able to run code through the application. Once the path traversal is achieved, reading files such as configuration, credentials, or logs can lead to significant local compromise.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade n8n‑workflow‑builder to a version newer than 0.11.0 once the vendor releases a fix.
  • If an immediate upgrade is not possible, run the application under a non‑privileged account with limited filesystem permissions to restrict the scope of files the component can access.
  • Remove or disable the update_node_from_file feature in production environments until a patch is applied.
  • Implement custom validation that normalizes and checks the filePath argument against an allowed directory list to prevent traversal attempts.

Generated by OpenCVE AI on July 31, 2026 at 12:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update_node_from_file. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Title makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal
First Time appeared Makafeli
Makafeli n8n-workflow-builder
Weaknesses CWE-22
CPEs cpe:2.3:a:makafeli:n8n-workflow-builder:*:*:*:*:*:*:*:*
Vendors & Products Makafeli
Makafeli n8n-workflow-builder
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 3:37 PM
Reserved
Jul 12, 2026, 11:35 AM

View source JSON

Updated
Jul 15, 2026, 3:37 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 2:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 12:30 PM

JSON