CVE-2026-49465 Details
Description
n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8N_RESTRICT_FILE_ACCESS_TO file sandbox. This allowed the contents of any local git repository accessible to the n8n process to be cloned into an allowed path and read, circumventing the access restrictions that correctly blocked direct file reads to the same paths. This vulnerability is fixed in 1.123.48, 2.21.8, and 2.22.4.
A vulnerability exists in n8n workflow automation platform versions prior to 1.123.48, 2.21.8, and 2.22.4. It allows authenticated users with permission to create or modify workflows to bypass file access restrictions. By supplying a local filesystem path as the source repository in the Git node's Clone operation or as the target repository in the Push operation, users can circumvent the 'N8N_RESTRICT_FILE_ACCESS_TO' file sandbox. This exploitation enables the contents of any local Git repository accessible to the n8n process to be cloned into an allowed path and read, effectively bypassing access restrictions that normally prevent direct file reads to those paths.
Users can upgrade to n8n versions 1.123.48, 2.21.8, or 2.22.4 to address this vulnerability. If an immediate upgrade is not possible, administrators can limit workflow creation and editing permissions to trusted users or disable the Git node by adding 'n8n-nodes-base.git' to the 'NODES_EXCLUDE' environment variable.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-5xp3-2w67-427v | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.48 >= 2.0.0, < 2.21.8 >= 2.22.0, < 2.22.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |