CVE-2026-58661
n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 10, 2026
- Updated
- Oct 29, 2026
- Reserved
- Jul 1, 2026
Description
n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
n8nn8n |
|
n8nn8n |
|
References
- GitHub Security Advisory (GHSA-w867-jm58-p9pv)vendor-advisory
- VulnCheck Advisory: n8n - Disk Space Exhaustion via Data-Table File Upload Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.