PT-2025-18136 · N8N · N8N
Mahmoud0X00
·
Published
2025-04-28
·
Updated
2025-05-09
·
CVE-2025-46343
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
n8n versions prior to 1.90.0
Description
The issue concerns stored Cross-Site Scripting (XSS) through the attachments view endpoint. n8n workflows can store and serve binary files, accessible to authenticated users. However, there is no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter, allowing the server to respond with any MIME type. This could enable malicious content to be interpreted and executed by the browser. An authenticated attacker with member-level permissions could exploit this by uploading a crafted HTML file containing malicious JavaScript. When another user visits the binary data endpoint with the MIME type set to
text/html, the script executes in the context of the user’s session, potentially allowing account takeover by changing the user’s email address in their account settings.Recommendations
For versions prior to 1.90.0, update to version 1.90.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the attachments view endpoint and limiting the types of files that can be uploaded to prevent malicious content from being served. Additionally, restrict the use of the GET parameter that controls the MIME type to prevent attackers from manipulating the server's response.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
N8N