{"id":"CVE-2026-72762","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-11T13:19:06.230","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance."},{"lang":"es","value":"Las versiones de n8n anteriores a 1.123.67, 2.31.5 y 2.32.1 contienen una vulnerabilidad de escritura arbitraria de archivos en el nodo ’Editar imagen’, que pasa su parámetro de formato de salida a la biblioteca de imágenes subyacente sin validación. Un usuario autenticado capaz de ejecutar flujos de trabajo puede proporcionar un valor de formato manipulado para escribir archivos arbitrarios fuera del directorio de trabajo del nodo en la instancia de n8n."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"n8n-io","product":"n8n","defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","versions":[{"version":"0","lessThan":"1.123.67","versionType":"semver","status":"affected"},{"version":"1.123.67","versionType":"semver","status":"unaffected"}]},{"vendor":"n8n-io","product":"n8n","defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","versions":[{"version":"0","lessThan":"2.32.1","versionType":"semver","status":"affected"},{"version":"2.32.1","versionType":"semver","status":"unaffected"}]},{"vendor":"n8n-io","product":"n8n","defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","versions":[{"version":"0","lessThan":"2.31.5","versionType":"semver","status":"affected"},{"version":"2.31.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-11T15:01:02.384427Z","id":"CVE-2026-72762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*","versionEndExcluding":"1.123.67","matchCriteriaId":"4CBABC9C-8053-4556-99DF-B6A7BB96DFC0"},{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.31.5","matchCriteriaId":"81F5627C-88DD-42DB-877F-2376B96FF05F"},{"vulnerable":true,"criteria":"cpe:2.3:a:n8n:n8n:2.32.0:*:*:*:*:node.js:*:*","matchCriteriaId":"4AC4E002-974B-4748-A5CB-F8A40E4F3B24"}]}]}],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c","source":"disclosure@vulncheck.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/n8n-before-arbitrary-file-write-via-edit-image-node","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}