CVE-2026-56352: n8n Path Traversal Vulnerability

CVE-2026-56352 Overview

CVE-2026-56352 is a path traversal vulnerability [CWE-22] in n8n versions before 2.19.3. The flaw resides in the legacy ExecuteWorkflow node's localFile source option, which reads workflow files from disk without enforcing the file-access checks applied by other file-reading nodes. Although the node has been hidden from the user interface since v1.2, it remains reachable through the REST API. Authenticated users with permission to create or modify workflows can supply arbitrary file paths, bypassing the N8N_RESTRICT_FILE_ACCESS_TO restriction.

Critical Impact
Authenticated attackers can enumerate arbitrary files on the host and, when a valid workflow JSON file is targeted, load and execute it outside the configured file-access boundary.

Affected Products

n8n workflow automation platform
All n8n versions prior to 2.19.3
Deployments relying on N8N_RESTRICT_FILE_ACCESS_TO for file-path sandboxing

Discovery Timeline

2026-07-15 - CVE-2026-56352 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-56352

Vulnerability Analysis

n8n exposes an ExecuteWorkflow node that supports multiple sources for loading a sub-workflow definition. One of these sources, localFile, reads a workflow JSON file directly from the local filesystem. The localFile handler predates n8n's standardized file-access sandbox and does not consult the N8N_RESTRICT_FILE_ACCESS_TO allow-list that governs other file-reading nodes. As a result, any authenticated user with workflow-create or workflow-modify permissions can supply an absolute or relative path outside the sandbox.

The primary consequence is arbitrary file-existence disclosure. The node returns different error behavior depending on whether the specified path resolves to a readable file, giving an attacker an oracle for probing the host filesystem. When the target path contains a valid workflow JSON document, the impact escalates: n8n parses the file and executes the workflow, allowing attacker-controlled logic to run inside the n8n process context.

Root Cause

The root cause is missing authorization for a legacy code path. Removing the node from the UI in v1.2 reduced its visibility but did not remove its REST API surface. The localFile loader was never retrofitted with the sandbox checks introduced for newer file-handling nodes, leaving a divergence between the declared security boundary and the actual runtime enforcement.

Attack Vector

An attacker with valid n8n credentials and workflow-editing permissions crafts a workflow that invokes ExecuteWorkflow with source=localFile and a filePath pointing outside the restricted directory. The request is submitted through the REST API, bypassing the hidden-node UI restriction. The attacker observes the response to determine file existence, or points the path to a planted or existing workflow JSON to trigger execution. Network access to the n8n instance and low-privileged authenticated access are the only prerequisites.

See the GitHub Security Advisory and the VulnCheck Advisory on n8n for additional technical detail.

Detection Methods for CVE-2026-56352

Indicators of Compromise

REST API calls creating or updating workflows that contain an ExecuteWorkflow node with source set to localFile.
Workflow definitions referencing filesystem paths outside directories declared in N8N_RESTRICT_FILE_ACCESS_TO.
Repeated workflow executions probing sensitive paths such as /etc/passwd, /proc/self/environ, or credential files.

Detection Strategies

Inspect stored workflow JSON in the n8n database for nodes of type n8n-nodes-base.executeWorkflow with a localFile source parameter.
Enable and review n8n audit logs for workflow create, update, and execute events performed by non-administrator accounts.
Correlate n8n process file-read syscalls with workflow execution IDs to identify accesses outside the sandbox directory.

Monitoring Recommendations

Forward n8n application and API logs to a centralized log platform and alert on ExecuteWorkflow invocations using the localFile source.
Monitor filesystem telemetry on hosts running n8n for reads by the n8n process targeting paths outside the intended workflow directory.
Track anomalous workflow creation rates from individual user accounts, which may indicate automated path enumeration.

How to Mitigate CVE-2026-56352

Immediate Actions Required

Upgrade n8n to version 2.19.3 or later, where the localFile source enforces the standard file-access checks.
Audit all existing workflows for ExecuteWorkflow nodes using the localFile source and remove or refactor them.
Review recent workflow creation and modification activity for accounts without a business need to invoke local file sources.
Rotate any credentials, tokens, or secrets stored on the n8n host that may have been exposed through arbitrary file reads.

Patch Information

The vendor has released a fix in n8n 2.19.3. The patch aligns the ExecuteWorkflowlocalFile handler with the N8N_RESTRICT_FILE_ACCESS_TO enforcement used by other file-reading nodes. Details are published in the GitHub Security Advisory GHSA-2vx9-7wpg-88jq.

Workarounds

Restrict workflow creation and modification permissions to a minimal set of trusted users until the upgrade is applied.
Run n8n under a dedicated low-privileged system account with filesystem permissions limited to the directories it must access.
Deploy n8n inside a container or sandbox that constrains its view of the host filesystem to only required paths.
Set and enforce N8N_RESTRICT_FILE_ACCESS_TO and validate that the runtime user cannot read sensitive files outside that scope.

bash

# Configuration example: constrain n8n file access and upgrade
export N8N_RESTRICT_FILE_ACCESS_TO="/data/n8n/workflows"
export N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true

# Upgrade to the patched version
npm install -g n8n@2.19.3
# or, for Docker deployments
docker pull n8nio/n8n:2.19.3