This vulnerability arises from insufficient file access restrictions within user‑created workflows. An authenticated user who has permission to create or modify workflows can instruct the system to read any file present on the host. The resulting leak of configuration files and credential data can allow a malicious user to gain full control over any account on the instance. This flaw is classified as a data confidentiality breach that potentially escalates to complete account takeover.

The affected product is the open‑source workflow automation platform from n8n‑io. Versions prior to 1.123.18 and prior to 2.5.0 are impacted; newer releases contain a fix.

The CVSS score of 9.4 denotes critical severity, but the EPSS score of less than 1 percent indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. The likely attack path requires the attacker to be authenticated and possess workflow creation rights; once granted, arbitrary file reads can be triggered by submitting a crafted workflow. The vulnerability thus poses a high risk to confidentiality and integrity for users with elevated workflow permissions.