CVE-2026-85170CWE-20

CVE-2026-85170

Medium · published September 3, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing the composer to read a local file accessible to the n8n process or fetch an internal URL (SSRF) and attach the result to the outgoing message.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-09-03T17:06Z
Affected products (3)
ProductVersionsFixed in
n8n/n8n< 1.123.731.123.73
n8n/n8n≥ 2.0.0, < 2.35.42.35.4
n8n/n8n≥ 2.36.0, < 2.36.22.36.2
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-95ph-833c-4wrp · [email protected]https://www.vulncheck.com/advisories/n8n-before-1.123.73-local-file-read-and-ssrf-via-gmail-and-brevo-nodes · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes
    cvelistv5