CVE-2026-56352 Details
Description
n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node's localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the REST API. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to bypass the N8N_RESTRICT_FILE_ACCESS_TO restriction and determine whether arbitrary files exist on the host; where the targeted path contains a valid workflow JSON file, that file can additionally be loaded and executed.
A file path restriction bypass vulnerability has been identified in n8n versions prior to 2.19.3. The issue resides in the legacy ExecuteWorkflow node's localFile source option, which allows workflow files to be read from disk without the file-access checks that other file-reading nodes enforce. Although this option has been hidden from the user interface since version 1.2, it remains accessible through the REST API. An authenticated user with the ability to create or modify workflows can exploit this vulnerability by supplying an arbitrary file path, bypassing the N8N_RESTRICT_FILE_ACCESS_TO restriction. This exploitation can be used to check for the existence of specific files on the host. If a valid workflow JSON file is located at the specified path, it can be loaded and executed, potentially triggering actions on connected downstream systems.
Users should upgrade to n8n version 2.20.0 or 2.19.3. If an immediate upgrade is not possible, consider restricting workflow creation and editing permissions to trusted users and limiting network access to the n8n REST API to trusted users only.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n | < 2.19.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |