n8n allows users to create workflows that include uploading files and then transferring them to remote servers through its SSH node. Before version 1.123.12 and 2.4.0 the SSH node did not validate the uploaded file’s metadata, allowing a file to be written to an arbitrary location on the destination server. If the attacker can execute code at the new location, this flaw can enable remote code execution on that server.

The vulnerable software is the n8n workflow automation platform from n8n‑io. All installations running a version older than 1.123.12 for the 1.x series or older than 2.4.0 for the 2.x series are affected. The vulnerability manifests when the workflow processes a file that is then sent to a remote host via the SSH node.

The CVSS score of this vulnerability is 7.1, indicating high impact, while the EPSS score is below 1 %, suggesting a low likelihood of exploitation at the present time. This issue is not recorded in the CISA KEV catalog. A likely attack vector would be an unauthenticated attacker who knows that an n8n workflow exists and that the file‑upload endpoint is open. The attacker can upload a crafted file, have the SSH node write it to a chosen path on the target remote system, and if the path allows code execution, gain control of that system. The vulnerability is mitigated by applying the patched versions or by enforcing stricter validation of uploaded file metadata before sending it over SSH.