CVE-2026-15521

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15521

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15521.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15521

Published

2026-07-13T01:30:09.205Z

Modified

2026-07-17T03:42:03.973276934Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal

Details

A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component updatenodefrom_file. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15521.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.2"
                },
                {
                    "last_affected": "0.2"
                },
                {
                    "introduced": "0.3"
                },
                {
                    "last_affected": "0.3"
                },
                {
                    "introduced": "0.4"
                },
                {
                    "last_affected": "0.4"
                },
                {
                    "introduced": "0.5"
                },
                {
                    "last_affected": "0.5"
                },
                {
                    "introduced": "0.6"
                },
                {
                    "last_affected": "0.6"
                },
                {
                    "introduced": "0.7"
                },
                {
                    "last_affected": "0.7"
                },
                {
                    "introduced": "0.8"
                },
                {
                    "last_affected": "0.8"
                },
                {
                    "introduced": "0.9"
                },
                {
                    "last_affected": "0.9"
                },
                {
                    "introduced": "0.11.0"
                },
                {
                    "last_affected": "0.11.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/makafeli/n8n-workflow-builder

Affected ranges

Type

GIT

Repo

https://github.com/makafeli/n8n-workflow-builder

Events

Introduced

629751da7419e34ae6963c7ae0adc452b0c8ebc0

Last affected

629751da7419e34ae6963c7ae0adc452b0c8ebc0

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.1"
        },
        {
            "last_affected": "0.1"
        },
        {
            "introduced": "0.10"
        },
        {
            "last_affected": "0.10"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.1

v0.*

v0.10.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15521.json"