CVE-2026-15521: n8n-workflow-builder Path Traversal Flaw

CVE-2026-15521 Overview

CVE-2026-15521 is a path traversal vulnerability [CWE-22] in the makafeli n8n-workflow-builder project through version 0.11.0. The flaw resides in an unspecified function within build/server.cjs, part of the update_node_from_file component. Attackers can manipulate the filePath argument to traverse directories outside the intended scope. Exploitation requires local access and low privileges. A public exploit is available, and the project maintainers were notified through an issue report but had not responded at the time of disclosure.

Critical Impact
Local authenticated attackers can traverse the file system through the filePath parameter of update_node_from_file, accessing or modifying files outside the intended directory.

Affected Products

makafeli n8n-workflow-builder versions up to and including 0.11.0
Component: update_node_from_file in build/server.cjs
Deployments exposing the workflow builder to local users

Discovery Timeline

2026-07-13 - CVE-2026-15521 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15521

Vulnerability Analysis

The vulnerability affects the update_node_from_file handler in build/server.cjs of the n8n-workflow-builder project. The handler accepts a filePath argument that is used to read or update workflow node files. The code fails to canonicalize or validate the supplied path against an allowed base directory. As a result, an attacker can supply sequences such as ../ to escape the intended workflow directory. This grants read or write access to arbitrary files reachable by the process user.

The attack requires local access and low-level privileges on the host running the workflow builder. Confidentiality, integrity, and availability impacts are all rated Low, reflecting the limited scope of a local-only vector. Public exploit code exists, increasing the likelihood of opportunistic abuse in shared or multi-tenant environments. The maintainer has not responded to the vulnerability report at the time of publication.

Root Cause

The root cause is missing input validation on the filePath argument passed to update_node_from_file. The function does not enforce a canonical path check or restrict resolution to a trusted base directory, mapping directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

A locally authenticated user invokes the update_node_from_file operation and provides a filePath value containing directory traversal sequences. The server resolves the traversed path and performs the file operation on the attacker-chosen target, enabling reading or writing files owned by the workflow builder process.

No verified proof-of-concept code is published in the enriched data. Refer to the VulDB Vulnerability Detail and the GitHub Issue Tracker for further technical context.

Detection Methods for CVE-2026-15521

Indicators of Compromise

Requests or invocations of update_node_from_file containing ../, ..\, or URL-encoded traversal sequences in the filePath argument
Access to files outside the intended workflow directory by the n8n-workflow-builder process
Unexpected modifications to configuration or credential files owned by the service account

Detection Strategies

Instrument build/server.cjs request logs to capture the raw filePath value and flag values that resolve outside the workflow root
Monitor process-level file access telemetry for the n8n-workflow-builder service and alert on reads or writes outside its working directory
Correlate local user sessions with anomalous invocations of the update_node_from_file endpoint

Monitoring Recommendations

Enable file integrity monitoring for directories adjacent to the workflow builder installation
Retain application logs for update_node_from_file invocations with source user, arguments, and result path
Review GitHub Issue Tracker for maintainer updates and patch availability

How to Mitigate CVE-2026-15521

Immediate Actions Required

Restrict local access to systems running n8n-workflow-builder to trusted administrators only
Run the workflow builder under a dedicated low-privilege service account with no access to sensitive files
Disable or gate the update_node_from_file functionality if not required in your deployment

Patch Information

No vendor patch is available at the time of publication. The maintainer of the GitHub Project Repository had not responded to the disclosure recorded in the VulDB CVE-2026-15521 entry. Track the upstream project and GitHub Issue Tracker for a fix.

Workarounds

Apply a local wrapper or reverse proxy filter that rejects filePath values containing .., absolute paths, or non-workflow directory prefixes
Enforce filesystem-level isolation using containers, chroot, or mandatory access control profiles such as AppArmor or SELinux
Remove write permissions from the service account on directories outside the workflow storage location

bash

# Example AppArmor snippet restricting the workflow builder process
/opt/n8n-workflow-builder/build/server.cjs {
  /opt/n8n-workflow-builder/workflows/** rw,
  deny /etc/** rwx,
  deny /root/** rwx,
  deny /home/** rwx,
}