Path Traversal in makafeli n8n-workflow-builder

Compliance Impact

The vulnerability allows an attacker with local access to perform arbitrary local file reads through the update_node_from_file tool by manipulating the filePath argument. This can lead to unauthorized disclosure of sensitive information such as configuration files, secrets, or source code embedded into n8n workflows and retrievable via the n8n API.

Such unauthorized access and potential exposure of sensitive data could negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

However, the vulnerability requires local access and the exploit is not remotely exploitable, which may limit the scope of compliance impact depending on the deployment environment and access controls in place.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-15521 is a vulnerability in the makafeli n8n-workflow-builder, specifically in the update_node_from_file component. It allows an attacker with local access to manipulate the filePath argument to perform a path traversal attack. This means the attacker can cause the system to read arbitrary local text files and embed their contents into n8n workflow nodes.

The vulnerability arises because the update_node_from_file tool does not restrict or validate the filePath argument, allowing any local file accessible to the MCP server process to be read. The file content is then inserted into a workflow node parameter and saved, making the sensitive data retrievable via the n8n API.

This issue is particularly dangerous in environments where AI assistants or automated tools use the MCP server, as untrusted input could be exploited to read sensitive files such as configuration files, secrets, or source code.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker with local access to read arbitrary local files on the server running the n8n-workflow-builder MCP server. Sensitive information such as configuration files, secrets, or source code could be exposed.

The attacker can embed the contents of these files into n8n workflow nodes, which can then be retrieved through the n8n API or workflow functionality, potentially leading to data leakage.

In environments where AI assistants automate workflow management, this vulnerability could be exploited to manipulate the assistant into reading and exposing sensitive data without direct user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the `update_node_from_file` tool in the n8n-workflow-builder which allows arbitrary local file reads via an uncontrolled `filePath` argument. Detection involves monitoring or testing for unauthorized or unexpected local file read attempts through this tool.

Since the exploit requires local access and involves the MCP client calling `update_node_from_file` with a crafted file path, detection can be done by checking logs or monitoring calls to this function for suspicious file paths.

You can attempt to detect exploitation by running commands or scripts that simulate the exploit locally, for example, by invoking the `update_node_from_file` with a known sensitive file path and checking if the file content is embedded into a workflow node.

• Check logs or audit trails for calls to `update_node_from_file` with unexpected or absolute file paths.
• Use a proof-of-concept script similar to the one described in Resource 1 to test if local file reads are possible.
• Monitor the n8n workflow nodes for unexpected content that may indicate embedded local file data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting local access to the MCP server and the `update_node_from_file` tool to trusted users only, since the attack requires local access.

Avoid running the vulnerable versions of n8n-workflow-builder (up to 0.11.0) and n8n (up to 2.21.7) in untrusted environments or without proper access controls.

Monitor and audit usage of the `update_node_from_file` tool to detect any suspicious file path arguments.

Consider disabling or restricting the `update_node_from_file` functionality until a patch or official fix is released.

Apply principle of least privilege to the MCP server process to limit file system access and prevent reading sensitive files.

Useful 0 Not Useful 0