CVE-2026-72762 Overview
CVE-2026-72762 is an arbitrary file write vulnerability in n8n, an open-source workflow automation platform. The flaw resides in the Edit Image node, which forwards its output format parameter to the underlying image library without validation. Authenticated users with permission to run workflows can supply a crafted format value to write files outside the node's working directory on the n8n instance. The issue is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type). It affects n8n versions prior to 1.123.67, 2.31.5, and 2.32.1.
Critical Impact
Authenticated attackers can write arbitrary files to the n8n host filesystem, enabling code execution paths, configuration tampering, and lateral movement inside the automation environment.
Affected Products
- n8n versions before 1.123.67
- n8n versions before 2.31.5
- n8n versions before 2.32.1
Discovery Timeline
- 2026-08-11 - CVE-2026-72762 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72762
Vulnerability Analysis
n8n exposes an Edit Image node that wraps an underlying image manipulation library to transform images inside workflows. The node accepts an output format parameter from the workflow definition and forwards it directly to the image library call. Because the parameter is not validated or constrained to a whitelist of supported formats, an attacker can inject filesystem path syntax into the value. When the library serializes the output, it interprets the crafted format string as a target path and writes bytes to an attacker-chosen location on disk.
The vulnerability requires an authenticated user who can create or execute workflows. It does not require administrative privileges within n8n. Successful exploitation compromises the confidentiality, integrity, and availability of the host, as arbitrary writes can overwrite executable content, configuration files, or credential stores available to the n8n process. See the GitHub Security Advisory for vendor details.
Root Cause
The root cause is missing input validation on the Edit Image node's format parameter. The node treats user-controlled workflow input as a trusted format identifier and passes it unchecked to the image library, allowing that value to influence the destination path of the write operation.
Attack Vector
An authenticated user constructs a workflow containing an Edit Image node and supplies a malicious value in the output format field. When the workflow executes, the underlying image library writes attacker-controlled bytes to a path outside the node's working directory. Attackers can chain this primitive with n8n's execution context to overwrite scripts, cron jobs, or supporting files that later run with the n8n service account.
No public proof-of-concept code is available. Refer to the VulnCheck Advisory on n8n for further technical context.
Detection Methods for CVE-2026-72762
Indicators of Compromise
- Unexpected file creation or modification outside the n8n data directory by the n8n process.
- Workflow execution logs referencing the Edit Image node with unusual, non-standard values in the output format field.
- New or modified files in system paths such as /etc/, /root/, or the n8n installation directory following workflow runs.
Detection Strategies
- Audit stored workflow JSON for Edit Image nodes whose format parameter contains path separators, traversal sequences, or file extensions inconsistent with image formats.
- Correlate n8n execution history with filesystem change events on the host to identify writes outside the working directory during Edit Image node runs.
- Alert on writes to sensitive paths performed by the n8n runtime user.
Monitoring Recommendations
- Enable file integrity monitoring on the n8n host, covering the application directory, user home directories, and system configuration paths.
- Forward n8n audit and execution logs to a centralized log platform and retain workflow definitions for post-incident review.
- Track creation of new workflows by low-privilege accounts and flag those that invoke the Edit Image node.
How to Mitigate CVE-2026-72762
Immediate Actions Required
- Upgrade n8n to version 1.123.67, 2.31.5, 2.32.1, or later depending on the deployed release branch.
- Review existing workflows for Edit Image nodes with attacker-controllable format parameters and remove or sanitize suspicious entries.
- Rotate credentials and API keys stored in the n8n instance if unauthorized workflow execution is suspected.
Patch Information
The n8n maintainers addressed the vulnerability by validating the Edit Image node's output format parameter against a fixed set of supported image formats. Fixed releases are 1.123.67, 2.31.5, and 2.32.1. Patch details are documented in the GitHub Security Advisory.
Workarounds
- Restrict workflow creation and execution permissions to trusted operators until the upgrade is applied.
- Run n8n under a dedicated, low-privilege service account with filesystem permissions limited to the n8n working directory.
- Deploy n8n inside a container with a read-only root filesystem and explicit writable volumes to constrain the impact of arbitrary writes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
