PT-2025-36488 · N8N · N8N

Nikolas-Ch · Published 2025-09-08 · Updated 2025-09-12 · CVE-2025-56265

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: N8N versions 1.95.3, 1.100.1, and 1.101.1

Description: An arbitrary file upload vulnerability exists in the Chat Trigger component of N8N. This allows attackers to execute arbitrary code by uploading a crafted HTML file.

Recommendations: Update N8N to a version newer than 1.95.3. Update N8N to a version newer than 1.100.1. Update N8N to a version newer than 1.101.1.

Exploit

Fix

RCE

Unrestricted File Upload

XSS

Weakness Enumeration

CWE-434

CWE-79

Related Identifiers

CVE-2025-56265

GHSA-V2X8-97XQ-8XRR

Affected Products

N8N

References · 14

• 🔥 https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1 · Exploit
• 🔥 https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload · Exploit
• 🔥 https://github.com/nikolas-ch/CVEs/blob/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload/StoredXSSviaUnristrictedFileUpload.txt · Exploit
• https://osv.dev/vulnerability/GHSA-v2x8-97xq-8xrr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-56265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56265 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/pull/18148 · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n%401.107.0 · Note
• https://t.me/cveNotify/134811 · Telegram Post
• https://twitter.com/CVEnew/status/1965108801608028602 · Twitter Post
• https://t.me/cveNotify/135356 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1965136377059631170 · Twitter Post
• https://t.me/CVEtracker/31974 · Telegram Post