PT-2025-36488 · N8N · N8N

Nikolas-Ch · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-56265

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

N8N versions 1.95.3, 1.100.1, and 1.101.1

Description:

An arbitrary file upload vulnerability exists in the Chat Trigger component of N8N. Attackers can execute arbitrary code by uploading a crafted HTML file.

Recommendations:

Update N8N to a version newer than 1.95.3, 1.100.1, and 1.101.1.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-56265

Affected Products

N8N

References · 6

• 🔥 https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1 · Exploit
• 🔥 https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload · Exploit
• 🔥 https://github.com/nikolas-ch/CVEs/blob/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload/StoredXSSviaUnristrictedFileUpload.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56265 · Security Note
• https://twitter.com/VulmonFeeds/status/1965136377059631170 · Twitter Post
• https://twitter.com/CVEnew/status/1965108801608028602 · Twitter Post