CVE-2023-27562: n8n Directory Traversal vulnerability
The n8n package prior to version 0.216.1 for Node.js allows Directory Traversal.
Published May 10, 2023 · Updated Nov 27, 2023
Affected packages
n8n
- Ecosystem
- npm
- Affected
- < 0.216.1
- Fixed in
- 0.216.1
- Check
npm ls n8n
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The n8n package prior to version 0.216.1 for Node.js allows Directory Traversal.
Credited to MarkLee131.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-27562
- https://www.synacktiv.com/sites/default/files/2023-05/Synacktiv-N8N-Multiple-Vulnerabilities_0.pdf
- https://github.com/n8n-io/n8n/releases/tag/n8n%400.216.1
- https://security.netapp.com/advisory/ntap-20230622-0007/
- https://github.com/n8n-io/n8n/pull/5522
- https://github.com/n8n-io/n8n/pull/5523
- https://github.com/n8n-io/n8n/commit/40b97846483fe7c58229c156acb66f43a5a79dc3
- https://github.com/n8n-io/n8n/commit/fb07d77106bb4933758c63bbfb87f591bf4a27dd
- https://github.com/advisories/GHSA-p58x-7733-vp9m
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More n8n vulnerabilities
All n8n entriesCVE-2026-86073
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
medium5.9Sep 10, 2026CVE-2026-86074
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
medium5.9Sep 10, 2026CVE-2026-86075
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
high8.7Sep 10, 2026CVE-2026-86076
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
high8.7Sep 10, 2026CVE-2026-86077
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
medium6.3Sep 10, 2026CVE-2026-86078
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
medium6.0Sep 10, 2026