PT-2026-57181 · N8N · N8N

Codebymoriarty · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-58661

Mitre

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-58661

Affected Products

N8N

References · 3

• https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-58661 · Security Note
• https://vulncheck.com/advisories/n8n-disk-space-exhaustion-via-data-table-file-upload-endpoint · Note