n8n: N8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the…
n8n
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-72773
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 11, 2026
- Source last modified
- October 24, 2026
Description
n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.
Description quoted from the NVD record.
Who is affected
This problem affects n8n, a tool for automating tasks by connecting apps and services into workflows. It affects versions before 2.31.5, and 2.32 versions before 2.32.1. The flaw is in a file search tool that is supposed to look only inside one chosen folder. A specially written search can escape that folder, so the tool returns the names and contents of other files on the computer that the n8n background service's user account can read. Any setup where someone can influence what the tool searches for is affected. This flaw is rated High.
What to do
- Find out who runs n8n for your organization: the person who installed it, or an IT provider or vendor who manages it for you.
- If your organization runs n8n itself, that person should update it to version
2.31.5, or to version2.32.1if you use a 2.32 version. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- After the update, check that n8n shows the new version number, and see the vendor advisory linked on this page for any further guidance about this flaw.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.