CVE-2026-72773
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.
Risk Assessment
An attacker could gain access to the contents of arbitrary local files, potentially leading to exposure of sensitive data. This is a serious risk to confidentiality.
Recommendation
Update n8n to version 2.31.5 or 2.32.1 to fix the path-confinement bypass in the search_files tool.
Original NVD description (English source)
n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.