n8n: Edit Image Node Format Injection Allows Arbitrary File Write
HighCVE-2026-72762 · Published Jul 22, 2026 · updated Aug 12, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | < 1.123.67 | 1.123.67 |
| >= 2.32.0, < 2.32.1 | 2.32.1 | |
| >= 2.0.0-rc.0, < 2.31.5 | 2.31.5 |
Details and references
## Impact The n8n Edit Image node passed its output format to the underlying image library without validation, so a crafted value could write bytes to a location outside the node's working directory. An authenticated user able to run workflows could use this to write arbitrary files in the n8n instance. ## Patches The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Disable the Edit Image node by adding `n8n-nodes-base.editImage` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-73
- Also known as
- CVE-2026-72762
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 22 | n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool CVE-2026-65015Highfixed in 2.29.8, 2.30.1 | High | 2.29.8, 2.30.1 |
| Jul 22 | n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution CVE-2026-65598Highfixed in 1.123.64, 2.29.8, 2.30.1 | High | 1.123.64, 2.29.8, 2.30.1 |
| Jul 22 | n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview CVE-2026-65597Highfixed in 1.123.64, 2.29.8, 2.30.1 | High | 1.123.64, 2.29.8, 2.30.1 |
| Jul 22 | n8n: Stored DOM XSS via Resource Locator `cachedResultUrl` CVE-2026-65592Highfixed in 1.123.64, 2.29.8, 2.30.1 | High | 1.123.64, 2.29.8, 2.30.1 |
| Jul 22 | n8n: Google Service Account Private Key Exposed in JWT Header CVE-2026-65599Mediumfixed in 1.123.64, 2.29.8, 2.30.1 | Medium | 1.123.64, 2.29.8, 2.30.1 |
| Jul 22 | n8n: Shared Credential Header Leak via HTTP Request Pagination Expression CVE-2026-59209Highfixed in 1.123.61, 2.27.4, 2.28.1 | High | 1.123.61, 2.27.4, 2.28.1 |