{"id":"CVE-2026-72762","revision":"7c215582d3c2497caaadaf6dbc05a004","records":[{"revision":"7c215582d3c2497caaadaf6dbc05a004","observedAt":"2026-10-25T15:19:03.401+00:00","statement":{"source":"nvd","id":"CVE-2026-72762","aliases":[],"title":"n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able t…","description":"n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.","state":0,"publishedAt":"2026-08-11T13:19:06.23+00:00","modifiedAt":"2026-10-24T15:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.7,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c","https://www.vulncheck.com/advisories/n8n-before-arbitrary-file-write-via-edit-image-node"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72762","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-434"],"productCriteria":["cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*","cpe:2.3:a:n8n:n8n:2.32.0:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-08-11T13:19:06.230","lastModified":"2026-10-24T15:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-72762","identifiers":["CVE-2026-72762"]},"retained":false,"historicalAffected":[]}],"coverage":[]}