What’s Vulnerable › Vulnerabilities

CVE-2026-72773: n8n before 2.32.1 Path Traversal via computer-use search_files

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-29
• Weakness: CWE-22

Description

n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.

Affected products

• n8n-io n8n: before 2.31.5; 2.32.0 (and their updates) — fixed in 2.31.5
• n8n-io n8n: from 2.32.0 before 2.32.1 — fixed in 2.32.1

How to fix

Upgrade to a fixed version: n8n-io n8n 2.31.5; n8n-io n8n 2.32.1. Check the vendor advisory for mitigations.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-pf2q-pxhf-hgmw
• https://www.vulncheck.com/advisories/n8n-before-path-traversal-via-computer-use-search-files

Get alerted when CVE-2026-72773 or the next vulnerability affects your stack