CyberRota Analysis
AI-GeneratedThe vulnerability affects n8n versions prior to 2.28.0 and 1.123.58, specifically in the data-table file upload endpoint, where the per-request quota check fails to consider files already stored in the shared temporary directory. This oversight allows authenticated users to upload files continuously, leading to potential disk space exhaustion until a cleanup occurs. Organizations using affected versions should prioritize remediation to prevent service disruptions due to storage limitations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
Related CVEs
Other vulnerabilities affecting the same vendor(s)