PT-2025-34160 · N8N · N8N

Mahmoud0X00 · Published 2025-08-20 · Updated 2025-08-21 · CVE-2025-57749

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.106.0

Description: n8n is a workflow automation platform. A symlink traversal vulnerability was discovered in the Read/Write File node. The node does not properly account for symbolic links (symlinks), allowing an attacker with the ability to create symlinks—such as by using the Execute Command node—to bypass directory restrictions and read from or write to otherwise inaccessible paths. Users of n8n.cloud are not impacted.

Recommendations: Update to version 1.106.0 or later. As a temporary workaround, disable or restrict access to the Execute Command node and any other nodes that allow arbitrary file system access. Avoid using the Read/Write File node on untrusted paths or inputs that could be manipulated via symlinks.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-61

Related Identifiers

CVE-2025-57749

GHSA-GGJM-F3G4-RWMM

Affected Products

N8N

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57749.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-ggjm-f3g4-rwmm · Vendor Advisory
• https://github.com/n8n-io/n8n/pull/17735 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-57749 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57749 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ggjm-f3g4-rwmm · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/commit/c2c3e08cdf33570d9051e659812cbfbdd3c077fd · Note
• https://twitter.com/CVEnew/status/1958397786757460297 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1958468485803041029 · Twitter Post
• https://t.me/CVEtracker/30532 · Telegram Post
• https://t.me/cveNotify/132955 · Telegram Post