External Control of File Name or Path in n8n - CVE-2026-126387
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU163078
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126387
CWE-ID: CWE-73
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated member to read arbitrary files accessible to the n8n server process, including instance configuration files.
The vulnerability exists due to the n8n browser_upload tool accepting absolute paths that are resolved on the server when Browser Use is enabled with N8N_INSTANCE_AI_BROWSER_USE_ENABLED=true. An authenticated member can connect their own browser session and supply a server file path to upload its contents into a page they can access.
Affected software
n8n
How to mitigate CVE-2026-126387
Install security update from vendor's website.
n8n - addressed in versions 2.45.5, 2.46.1, 3.0.1