●PocketClawAI security alerts
Sign in
mediumCVSS 6.5NVD status: Analyzed

CVE-2025-57749

n8n is a workflow automation platform.

Componentn8n
Severitymedium (CVSS 6.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published (NVD)2025-08-20
Last modified2026-06-17
Affected versions
n8n < 1.106.0
Fixed in1.106.0
WeaknessCWE-59
CISA KEVnot listed

NVD description

n8n is a workflow automation platform. Before 1.106.0, a symlink traversal vulnerability was discovered in the Read/Write File node in n8n. While the node attempts to restrict access to sensitive directories and files, it does not properly account for symbolic links (symlinks). An attacker with the ability to create symlinks—such as by using the Execute Command node—could exploit this to bypass the intended directory restrictions and read from or write to otherwise inaccessible paths. Users of n8n.cloud are not impacted. Affected users should update to version 1.106.0 or later.

Does CVE-2025-57749 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for n8n.
Check my stack

What to do

  • Upgrade n8n to 1.106.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other n8n CVEs

high
CVE-2026-103247CVSS 8.5

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper gua...

n8n
2026-10-01high
CVE-2026-103249CVSS 7.6

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerabilit...

n8n
2026-10-01critical
CVE-2026-103255CVSS 9

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase...

n8n
2026-10-01high
CVE-2026-103246CVSS 7.7

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attac...

n8n
2026-10-01critical
CVE-2026-103248CVSS 9

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supaba...

n8n
2026-10-01high
CVE-2026-103250CVSS 8.1

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB...

n8n
2026-10-01

All n8n CVEs