n8n: Edit Image Node Format Injection Allows Arbitrary File Write
n8n
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Record
- GHSA-xmc9-4f2h-jf9c
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 22, 2026
- Source last modified
- July 22, 2026
Description
Impact
The n8n Edit Image node passed its output format to the underlying image library without validation, so a crafted value could write bytes to a location outside the node's working directory. An authenticated user able to run workflows could use this to write arbitrary files in the n8n instance.
Patches
The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Disable the Edit Image node by adding n8n-nodes-base.editImage to the NODES_EXCLUDE environment variable.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Description quoted from the GitHub Advisory Database.
Who is affected
This flaw affects n8n, a tool that automates tasks by linking apps and services together into step-by-step workflows. The problem is in the Edit Image building block, which changes pictures as part of a workflow. It did not check the image format it was given, so a specially crafted value could save data outside the place it is meant to use. Someone who is logged in to your n8n and allowed to run workflows could use this to write any files they choose in your n8n installation. Installations not yet updated to a fixed release are affected. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should handle this. If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- Update n8n to version
1.123.67,2.31.5or2.32.1, or a later version. - If you cannot update right away, limit access to your n8n to fully trusted users only.
- As another short-term measure, turn off the Edit Image building block by adding
n8n-nodes-base.editImageto theNODES_EXCLUDEenvironment variable (a setting for the n8n installation). - These short-term measures do not fully remove the risk, so still plan to update as soon as you can.
Analysis written from the source record as of July 22, 2026 and reviewed before publishing.