A critical path traversal vulnerability in n8n allows unauthenticated remote attackers to execute arbitrary code on connected systems by manipulating file metadata.

This is a path traversal flaw (CWE-22) occurring when the SSH node processes uploaded files without validating metadata. An unauthenticated attacker capable of accessing an exposed file upload endpoint can leverage this to write files to arbitrary directories on remote systems.

Successful exploitation grants an attacker the ability to overwrite critical system files or upload malicious scripts to remote servers, leading to full remote code execution. Given the CVSS score of 8.1, this vulnerability presents a significant risk to the integrity and availability of automated infrastructure, potentially allowing lateral movement within the network.

Immediate Action: Update n8n instances to version 1.123.12 or 2.4.0 immediately to apply the necessary metadata validation fixes.

Proactive Monitoring: Review web server and application logs for suspicious file upload patterns or requests targeting the SSH node endpoints.

Compensating Controls: Implement strict network ingress filtering to ensure that file upload endpoints are not exposed to the public internet unless absolutely necessary.

Public Exploit Available: Unknown

Organizations utilizing n8n for workflow automation must prioritize patching this vulnerability to prevent potential remote code execution. Due to the nature of the flaw, verify that all relevant instances are updated to the specified patched versions and perform an audit of current workflows to ensure no unauthorized SSH nodes are exposed to unauthenticated users.