https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 00:24:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337935 EUVD-2026-337935 https://cve.radiocsirt.org/vuln/euvd-2026-337935 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56352 <p>n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node&#39;s localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the REST API. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to bypass the N8N_RESTRICT_FILE_ACCESS_TO restriction and determine whether arbitrary files exist on the host; where the targeted path contains a valid workflow JSON file, that file can additionally be loaded and executed.</p> <p>n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node&#39;s localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the REST API. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to bypass the N8N_RESTRICT_FILE_ACCESS_TO restriction and determine whether arbitrary files exist on the host; where the targeted path contains a valid workflow JSON file, that file can additionally be loaded and executed.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56352 https://cve.radiocsirt.org/vuln/ghsa-w243-4jxf-88rr <p>n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node&#39;s localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the REST API. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to bypass the N8N_RESTRICT_FILE_ACCESS_TO restriction and determine whether arbitrary files exist on the host; where the targeted path contains a valid workflow JSON file, that file can additionally be loaded and executed.</p> <p>n8n before 2.19.3 contains a file path restriction bypass in the legacy ExecuteWorkflow node&#39;s localFile source option, which reads workflow files from disk without the file-access checks enforced by other file-reading nodes. Although hidden from the UI since v1.2, it remains reachable via the REST API. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to bypass the N8N_RESTRICT_FILE_ACCESS_TO restriction and determine whether arbitrary files exist on the host; where the targeted path contains a valid workflow JSON file, that file can additionally be loaded and executed.</p> https://cve.radiocsirt.org/vuln/ghsa-w243-4jxf-88rr https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1589 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in n8n ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in n8n ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1589