The vulnerability stems from a type confusion flaw in the Send Email node of n8n. Because the node does not force message body fields to be strings, an attacker can inject a non‑string value that the mail library interprets as a file path or URL. This enables reading arbitrary local files and performing SSRF attacks. The weakness is a classic example of CWE‑843.

Vulnerable releases include n8n 1.x versions earlier than 1.123.67, 2.x versions up to 2.31.4, and 2.32.x versions before 2.32.1. The affected vendor is n8n‑io and the product is n8n, deployed on Node.js environments.

The CVSS score of 8.2 marks the flaw as high severity, while the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires an existing workflow that contains an unauthenticated webhook, the Send Email node configured with valid SMTP credentials, and untrusted input mapped directly into the body field. These conditions suggest that while the attack vector is limited, the impact and potential damage are significant for affected deployments.