CyberRota Analysis
AI-GeneratedVersions of n8n prior to 1.123.67, 2.31.5, and 2.32.1 are vulnerable to an arbitrary file write issue in the Edit Image node, allowing authenticated users to exploit this flaw by providing a malicious output format parameter. This can lead to unauthorized file creation outside the designated working directory, potentially compromising the integrity of the system. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.