CVE-2026-54687
criticalpriority · track · 39EPSS 0.008 · 56 %ileDEUSEPSS · scored 2026-10-28
n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–critical · 2.4–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3067n8n: Schwachstelle ermöglicht Manipulation von Dateien und Offenlegung von InformationenDeutsch2026-08-27csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in n8n ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.
- GHSA-q7m3-rhxg-7vxrn8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)2026-08-27ghsa · osvUS
## Affected versions < 1.0.0 ## Patched version 1.0.0 ## Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the db_path field could allow an attacker to control which file was opened by SQLite, potentially enabling path traversal to read or overwrite arbitrary files accessible to the n8n process. The vulnerability requires the workflow author to explicitly wire untrusted input to the db_path parameter, so it does not affect standalone deployments where only trusted users author workflows. However, in multi-tenant or user-facing n8n deployments the risk is elevated. Fixed in v1.0.0 by moving the database path into a credential (v2 node architecture), which is stored server-side and not controllable by workflow input data. ## References - Fix commit: 145a887 - Introduced credential-based path: v2 node ## Credits dyingman1 (role: Reporter)
sources
Which sources assert this record, and when.
references (3) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan