Description
n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
Published: 2026-07-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) allows an authenticated user to upload arbitrary files to a temporary directory without checking if quota is already exhausted accumulate until the space on the host. This vulnerability satisfies CWE-770, as the application fails to enforce resource limits, and the impact is denial of service due to loss of disk capacity.

Affected Systems

n8n versions older than 2.28.0 on the 2.x branch or older than 1.123.58 on the 1.x branch are affected. The vulnerability exists in both the 1.x and 2.x product lines of n8n.

Risk and Exploitability

Moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in KEV. It is inferred that the attack vector is via the web interface. The vulnerability does not allow remote code execution or privilege escalation.

Generated by OpenCVE AI on July 26, 2026 at 13:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a fixed release of n8n (version 2.28.0 or later on the possible, restrict or disable the data‑table file upload endpoint for unauthenticated users or users without elevated privileges.
  • Move the shared temporary directory to a separate partition or enforce stricter quota limits, and monitor disk usage regularly to detect early cleanup tasks run promptly and verify that the cleanup script removes files created by authenticated uploads.
  • Configure the web server or application to enforce maximum file upload size limits and restrict upload endpoints to prevent large files from being accepted.

Generated by OpenCVE AI on July 26, 2026 at 13:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-w867-jm58-p9pv n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads
History

Fri, 10 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
Title n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint
First Time appeared N8n
N8n n8n
Weaknesses CWE-770
CPEs cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
Vendors & Products N8n
N8n n8n
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

N8n N8n
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-10T16:43:29.322Z

Reserved: 2026-07-01T21:54:37.946Z

Link: CVE-2026-58661

cve-icon Vulnrichment

Updated: 2026-07-10T16:43:24.692Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T13:45:03Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling