CVE-2026-58661CWE-770

n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint

Medium · published July 10, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00386 · 31.5th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-10T13:58Z
EPSS history
Timeline
  • 10 JUL 13:58Z
    n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint
    cvelistv5