A flaw in n8n’s handling of webhook request data allows an attacker who does not possess authentication credentials to retrieve arbitrary files from the server. The vulnerability is an input validation issue (CWE‑20) that enables an unauthenticated remote attacker to read sensitive information from the underlying filesystem. If the attacker can read configuration files or other assets, further compromise may be possible depending on the deployment context and the workflows in use.

The open source workflow automation platform n8n is affected. Vulnerable versions include all releases from 1.65.0 through the 1.120.x series; the issue is fixed in version 1.121.0 and later.

The CVSS score of 10.0 reflects a critical severity, and the EPSS score of 7% suggests a moderate but realistic likelihood that the flaw will be exploited in the near future. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires sending a specially crafted webhook‑style request to an exposed n8n instance, which is feasible over the network and does not require any pre‑existing user privileges. Once triggered, the attacker can access any file that the n8n process can read.