CVE-2026-72762 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances, workflow automation, user access management, and security teams should assess exposure and prioritize remediation. Roles responsible for n8n instance management and workflow automation should review compensating controls and verify instance versions.

Why it matters

Defenders should care about CVE-2026-72762 because it allows authenticated users to write arbitrary files on n8n instances, potentially leading to further exploitation. Roles responsible for n8n instance management, workflow automation, and user access should assess exposure and prioritize remediation. The vulnerability's impact is supported by the CVE record and NVD entry, but evidence is limited to official sources and vendor advisories.

• An authenticated user can write arbitrary files outside the node's working directory.
• Successful exploitation requires workflow execution privileges.
• Remediation involves upgrading to fixed versions of n8n.
• Verification of instance versions and monitoring for suspicious activity are necessary.

Technical summary

The n8n workflow automation tool contains an arbitrary file write vulnerability in the Edit Image node. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance. Affected versions include those before 1.123.67, 2.31.5, and 2.32.1. The vulnerability allows an authenticated user to write arbitrary files on n8n instances, potentially leading to further exploitation. Successful exploitation requires workflow execution privileges.

Defensive priority

Defenders should prioritize verifying and upgrading n8n instances to the fixed versions, restricting access to workflow execution, and monitoring for suspicious file writes.

Recommended defensive actions

• Verify n8n instance versions and upgrade to 1.123.67, 2.31.5, or 2.32.1 if necessary.
• Restrict access to workflow execution to trusted users.
• Monitor n8n instance file systems for suspicious writes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and references to vendor advisories. Evidence is limited to official sources and vendor advisories. Defenders should verify n8n instance versions and review workflow execution privileges to assess exposure. Limited evidence suggests that an authenticated user can write arbitrary files outside the node's working directory, potentially leading to further exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.