Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD5.3 Medium

CVE-2026-58661

n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n n8n

Default version status: unaffected

  • 2.0.0 to < 2.28.0affected
  • 2.28.0unaffected
pkg:npm/n8n

n8n n8n

Default version status: unaffected

  • 0 to < 1.123.58affected
  • 1.123.58unaffected
pkg:npm/n8n

References