CVE-2026-15521
makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal
CVSS Score
5.3
EPSS Score
0.1%
EPSS Percentile
4th
A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update_node_from_file. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-22 |
| Vendor | makafeli |
| Product | n8n-workflow-builder |
| Published | Jul 13, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for makafeli n8n-workflow-builder
Be the first to know when new medium vulnerabilities affecting makafeli n8n-workflow-builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
makafeli / n8n-workflow-builder
0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0.10 0.11.0
References
vuldb.com: https://vuldb.com/vuln/377850 vuldb.com: https://vuldb.com/vuln/377850/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15521 vuldb.com: https://vuldb.com/submit/854522 github.com: https://github.com/makafeli/n8n-workflow-builder/issues/28 github.com: https://github.com/makafeli/n8n-workflow-builder/
Credits
🔍 Mcfly_Zhang (VulDB User) VulDB CNA Team