High · published February 4, 2026
⚡ An unauthenticated attacker could exploit a crafty quirk in your n8n workflows, leading to remote code execution with a simple file upload! Think of it like sending a delivery to the wrong address without checking the recipient's identity — you could inadvertently hand over sensitive documents to the wrong person, and they could do whatever they want with it! If an attacker knows your workflows and the file upload endpoints are open, they could hijack your server, write files anywhere they please, and run malicious code. This could spell disaster, leading to data breaches, unauthorized access, or even total system control!
Think of it like sending a delivery to the wrong address without checking the recipient's identity — you could inadvertently hand over sensitive documents to the wrong person, and they could do whatever they want with it! This vulnerability in n8n allows attackers to write files to unintended remote locations when workflows process uploaded files via the SSH node, without validating the file metadata. Prior to versions 1.123.12 and 2.4.0, this flaw could be exploited by an unauthenticated user if they have knowledge of the workflows.
If an attacker knows your workflows and the file upload endpoints are open, they could hijack your server, write files anywhere they please, and run malicious code. This could spell disaster, leading to data breaches, unauthorized access, or even total system control! To protect your systems, update n8n to versions 1.123.12 or 2.4.0 immediately. Additionally, ensure that your file upload endpoints require authentication to prevent unauthorized access to your workflows. Regularly audit your workflows to close any potential gaps! You've got this! Take action now and you'll strengthen your n8n instance like a pro! 🛡️