CVE-2026-15521: path traversal via filePath arg

CISO Take

A path traversal flaw in makafeli's n8n-workflow-builder (≤0.11.0) lets the filePath argument of the update_node_from_file function escape the intended workflow directory and read or write arbitrary files reachable by the server process. This matters because n8n-workflow-builder is a local tool typically wired into an AI agent's workflow-editing loop, so an agent that ingests untrusted content (a ticket, document, or chat message) could be manipulated into supplying the traversal path itself, turning a nominally local-access bug into something an indirect prompt injection can trigger. A public exploit already exists, the maintainer was notified via a GitHub issue and has not responded, and there is no CISA KEV listing or EPSS score to suggest active mass exploitation, keeping this at medium urgency rather than critical. With no fix available, treat this as an unpatched local file-access primitive: restrict or disable the update_node_from_file capability, sandbox the process, and monitor for file reads/writes outside the expected workflow paths.

Sources: NVD vuldb.com github.com ATLAS

What is the risk?

CVSS 5.3 (medium) reflects a local, low-complexity, low-privilege attack requiring no user interaction, with limited confidentiality/integrity/availability impact per the vector (C:L/I:L/A:L). The real-world risk is elevated by two factors the base score doesn't fully capture: a public exploit is already available, and the maintainer has gone unresponsive to a private disclosure, meaning no timely fix should be expected. Because the vulnerable component is a file-manipulation tool exposed to an AI agent's tool-calling surface, the effective attack surface can be broader than a purely local CVSS vector suggests if the agent's inputs are not fully trusted. Downstream exposure (dependent projects, deployment footprint) is unknown, which itself is a gap worth tracking rather than a reassurance.

How does the attack unfold?

Tool Invocation

An AI agent (or an attacker with local access) invokes the n8n-workflow-builder update_node_from_file function with a crafted filePath argument containing directory traversal sequences.

AML.T0053

Path Traversal Exploitation

build/server.cjs fails to sanitize or canonicalize the filePath argument, allowing the file read/write operation to escape the intended workflow directory (CWE-22).

AML.T0037

Impact

The attacker reads sensitive local files (credentials, config) or overwrites files reachable by the server process, resulting in data leakage or local integrity impact.

Tool Invocation

An AI agent (or an attacker with local access) invokes the n8n-workflow-builder update_node_from_file function with a crafted filePath argument containing directory traversal sequences.

AML.T0053

Path Traversal Exploitation

build/server.cjs fails to sanitize or canonicalize the filePath argument, allowing the file read/write operation to escape the intended workflow directory (CWE-22).

AML.T0037

Impact

The attacker reads sensitive local files (credentials, config) or overwrites files reachable by the server process, resulting in data leakage or local integrity impact.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

No patched release exists as of this CVE (maintainer unresponsive to the issue report), so mitigation is workaround-based: (1) disable or remove the update_node_from_file tool/function from any AI agent's available tool set until a fix ships; (2) run n8n-workflow-builder in a sandboxed/containerized environment with a minimal filesystem mount so traversal has nothing sensitive to reach; (3) add an input-validation wrapper in front of the MCP/tool boundary that rejects filePath values containing '..' segments or resolves paths and enforces they stay within an allow-listed workflow directory; (4) audit any environment where this tool is exposed to untrusted or agent-generated input (e.g., content pulled from external documents) since that is the realistic trigger path for a nominally 'local' bug; (5) monitor file-access logs for reads/writes outside the expected workflow directory as a detection signal.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Code Execution Agent Plugin AML.T0037 - Data from Local System AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-15521?

A path traversal flaw in makafeli's n8n-workflow-builder (≤0.11.0) lets the filePath argument of the update_node_from_file function escape the intended workflow directory and read or write arbitrary files reachable by the server process. This matters because n8n-workflow-builder is a local tool typically wired into an AI agent's workflow-editing loop, so an agent that ingests untrusted content (a ticket, document, or chat message) could be manipulated into supplying the traversal path itself, turning a nominally local-access bug into something an indirect prompt injection can trigger. A public exploit already exists, the maintainer was notified via a GitHub issue and has not responded, and there is no CISA KEV listing or EPSS score to suggest active mass exploitation, keeping this at medium urgency rather than critical. With no fix available, treat this as an unpatched local file-access primitive: restrict or disable the update_node_from_file capability, sandbox the process, and monitor for file reads/writes outside the expected workflow paths.

Is CVE-2026-15521 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-15521, increasing the risk of exploitation.

How to fix CVE-2026-15521?

No patched release exists as of this CVE (maintainer unresponsive to the issue report), so mitigation is workaround-based: (1) disable or remove the update_node_from_file tool/function from any AI agent's available tool set until a fix ships; (2) run n8n-workflow-builder in a sandboxed/containerized environment with a minimal filesystem mount so traversal has nothing sensitive to reach; (3) add an input-validation wrapper in front of the MCP/tool boundary that rejects filePath values containing '..' segments or resolves paths and enforces they stay within an allow-listed workflow directory; (4) audit any environment where this tool is exposed to untrusted or agent-generated input (e.g., content pulled from external documents) since that is the realistic trigger path for a nominally 'local' bug; (5) monitor file-access logs for reads/writes outside the expected workflow directory as a detection signal.

What systems are affected by CVE-2026-15521?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool integrations.

What is the CVSS score for CVE-2026-15521?

CVE-2026-15521 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool integrations

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update_node_from_file. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An operator deploys n8n-workflow-builder as a local tool an AI coding/workflow agent can call to update n8n node definitions from files on disk. An attacker — or content the agent ingests from an untrusted source (a document, ticket, or webhook payload processed as part of an indirect prompt injection) — causes the agent to invoke update_node_from_file with a crafted filePath such as a relative path escaping the workflow directory (e.g., targeting SSH keys, .env files, or other local secrets). Because the server does not canonicalize or restrict the path, it reads (or overwrites) the targeted file outside the sandbox, leaking credentials or corrupting configuration. The low privilege and no-user-interaction requirements mean that once the agent's tool-calling loop can be steered toward a malicious path, exploitation is straightforward and repeatable, especially since a public PoC already exists.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.