n8n Symlink Traversal Vulnerability in Read/Write File Node

A symlink traversal vulnerability exists in n8n workflow automation platform versions prior to 1.106.0. The issue arises in the Read/Write File node, which inadequately manages symbolic links, allowing attackers to bypass directory restrictions and access restricted files. This vulnerability can be exploited by users who can create symlinks, such as through the Execute Command node. n8n.cloud users are not affected.

Impact

Exploitation allows unauthorized access to restricted files and directories, enabling reading from or writing to otherwise inaccessible paths.

Remediation

Users should update to n8n version 1.106.0 or later. Affected users can also disable or restrict access to the Execute Command node and avoid using the Read/Write File node on untrusted paths that could be manipulated with symlinks.