Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-58661

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:8b02909a78454744637f3522339c4162ca34156e65c910efb174613465e76f05
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n","versions":[{"lessThan":"2.28.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.28.0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:967c8e46c7786b920dd02d0cbec1d575e60426a2e6c26b158ddf0921dc9919c9 · sha256:c8366bc3b5423698… · /containers/cna/affected/0

{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n","versions":[{"lessThan":"1.123.58","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.123.58","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:967c8e46c7786b920dd02d0cbec1d575e60426a2e6c26b158ddf0921dc9919c9 · sha256:c8366bc3b5423698… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n","versions":[{"lessThan":"2.28.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.28.0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:967c8e46c7786b920dd02d0cbec1d575e60426a2e6c26b158ddf0921dc9919c9 · sha256:c8366bc3b5423698… · /containers/cna/affected/0
{"defaultStatus":"unaffected","packageURL":"pkg:npm/n8n","product":"n8n","vendor":"n8n","versions":[{"lessThan":"1.123.58","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.123.58","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:967c8e46c7786b920dd02d0cbec1d575e60426a2e6c26b158ddf0921dc9919c9 · sha256:c8366bc3b5423698… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:967c8e46c7786b920dd02d0cbec1d575e60426a2e6c26b158ddf0921dc9919c9 · sha256:c8366bc3b5423698… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:967c8e46c7786b920dd02d0cbec1d575e60426a2e6c26b158ddf0921dc9919c9 · sha256:c8366bc3b5423698… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"name":"GitHub Security Advisory (GHSA-w867-jm58-p9pv)","tags":["vendor-advisory"],"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:967c8e46c7786b920dd02d0cbec1d575e60426a2e6c26b158ddf0921dc9919c9 · sha256:c8366bc3b5423698… · /containers/cna/references/0
{"name":"VulnCheck Advisory: n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/n8n-disk-space-exhaustion-via-data-table-file-upload-endpoint"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:967c8e46c7786b920dd02d0cbec1d575e60426a2e6c26b158ddf0921dc9919c9 · sha256:c8366bc3b5423698… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer