---
id: CVE-2026-72762
title: >-
  n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file
  write vulnerability in the Edit Image node, which passes its output format
  parameter to the underlying image library without validation
summary: >-
  n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file
  write vulnerability in the Edit Image node, which passes its output format
  parameter to the underlying image library without validation. An authenticated
  user abl…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-434
vendor: n8n
product: n8n
affected:
  - n8n < 1.123.67
  - 'n8n >= 2.0.0, < 2.31.5'
  - n8n = 2.32.0
patched:
  - n8n 2.31.5
published: '2026-08-11'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:47:49.423'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72762'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/n8n-before-arbitrary-file-write-via-edit-image-node
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00476
epssPercentile: 0.38512
ingestedAt: '2026-09-09T21:22:45.526Z'
---

## Overview

n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.

## Affected

- `n8n < 1.123.67`
- `n8n >= 2.0.0, < 2.31.5`
- `n8n = 2.32.0`

## Remediation

Upgrade past the affected range:

- `n8n 2.31.5`