A path traversal vulnerability in n8n allows authenticated attackers to perform unauthorized file operations, creating a significant security risk.

The application suffers from a path traversal vulnerability (CWE-22) that allows an authenticated user to escape the intended directory structure. This occurs when processing file paths, potentially granting access to sensitive system files.

An attacker with valid application credentials could leverage this flaw to read configuration files or overwrite critical system files, potentially leading to remote code execution or data theft. The CVSS score of 8.7 reflects the high potential for total impact on the confidentiality and integrity of the affected server.

Immediate Action: Update n8n to version 2.34.1 or 2.33.4, or the latest available release, to patch the traversal flaw.

Proactive Monitoring: Review audit logs for suspicious file system interactions or access attempts to files outside the expected data storage paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing directory traversal sequences like double dots and slashes.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates an immediate update to the specified patched versions. Organizations should ensure their n8n instances are updated promptly to mitigate the risk of unauthorized file system interaction.