PT-2026-6265 · N8N · N8N

Nlgbao1340 · Published 2026-02-04 · Updated 2026-02-05 · CVE-2026-25056

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.118.0 n8n versions prior to 2.4.0

Description n8n is a workflow automation platform. A flaw in the Merge node’s SQL Query mode permitted authenticated users with workflow creation or modification rights to write arbitrary files to the n8n server’s filesystem, potentially resulting in remote code execution. The issue affects users with the ability to create or modify workflows.

Recommendations Update to n8n version 1.118.0 or later. Update to n8n version 2.4.0 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Protection Mechanism Failure

Weakness Enumeration

CWE-434

CWE-693

Related Identifiers

BDU:2026-02171

CVE-2026-25056

GHSA-HV53-3329-VMRM

Affected Products

N8N

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25056.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-hv53-3329-vmrm · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02171 · Security Note
• https://osv.dev/vulnerability/GHSA-hv53-3329-vmrm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25056 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25056 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/TheHackerWire/status/2019544314402206091 · Twitter Post
• https://twitter.com/AhammodOvi69/status/2019422819944157578 · Twitter Post
• https://twitter.com/CVEnew/status/2019110900834398375 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2019162672344809645 · Twitter Post
• https://twitter.com/pulsepatchio/status/2019427303349198938 · Twitter Post