CVE-2026-25055: 
NixOS vulnerability analysis and mitigation

CVE-2026-25055 is a path traversal (arbitrary file write) vulnerability in n8n, an open-source workflow automation platform, affecting its SSH node component. When workflows process uploaded files and transfer them to remote servers via the SSH node without validating file metadata, an unauthenticated attacker can cause files to be written to arbitrary locations on those remote systems, potentially leading to remote code execution. The vulnerability affects n8n versions prior to 1.123.12 and versions 2.0.0 through 2.3.x (prior to 2.4.0). It was disclosed on February 4, 2026, with a CVSS v4.0 score of 7.1 (High) and a CVSS v3.1 score of 8.1 (High) (GitHub Advisory, n8n Security Advisory).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The n8n SSH node fails to validate or sanitize file metadata (such as filenames) when transferring uploaded files to remote servers, allowing an attacker to supply path traversal sequences (e.g., ../../) in the filename to write files outside the intended destination directory on the remote system. Exploitation requires two preconditions: the attacker must have knowledge of a vulnerable workflow that accepts file uploads and forwards them via SSH, and the file upload endpoint must be unauthenticated. A PoC was noted as available by Field Effect and a Nuclei template pull request was submitted to ProjectDiscovery, indicating public exploit tooling exists (GitHub Advisory, Field Effect).

Successful exploitation allows an unauthenticated attacker to write arbitrary files to any location on remote systems connected via n8n's SSH node, with high impact to confidentiality, integrity, and availability of those subsequent systems. The most severe consequence is remote code execution on the remote SSH-connected systems — for example, by overwriting authorized SSH keys, cron jobs, or web-accessible scripts. The n8n platform itself (the vulnerable system) is not directly impacted in terms of confidentiality or integrity, but the downstream remote systems face full compromise (GitHub Advisory, n8n Security Advisory).

A public proof-of-concept is available, as noted by Field Effect's blog post and a Nuclei template pull request submitted to ProjectDiscovery (Field Effect, Nuclei Templates PR). There is no confirmed evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.179% (39th percentile), indicating a relatively low but non-negligible probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA KEV catalog as of the time of this report.

1. Reconnaissance: Identify publicly accessible n8n instances running versions prior to 1.123.12 or 2.0.0–2.3.x using tools like Shodan or Censys, searching for n8n webhook endpoints or login pages.
2. Identify vulnerable workflows: Enumerate unauthenticated webhook endpoints on the target n8n instance (e.g., via /webhook/ paths) to find workflows that accept file uploads and forward them via the SSH node.
3. Craft malicious file upload: Prepare a file upload request where the filename contains path traversal sequences (e.g., ../../.ssh/authorized_keys or ../../etc/cron.d/backdoor) to target a sensitive location on the remote SSH server.
4. Submit the payload: Send a multipart HTTP POST request to the unauthenticated webhook endpoint with the crafted filename and a malicious file payload (e.g., an attacker-controlled SSH public key or a cron job script).
5. Achieve remote code execution: Once the file is written to the intended location on the remote SSH server (e.g., appending to ~/.ssh/authorized_keys), the attacker can SSH into the remote system using the corresponding private key, achieving full remote code execution (GitHub Advisory, Field Effect).

• Network: Unusual multipart HTTP POST requests to n8n webhook endpoints (/webhook/) containing filenames with path traversal sequences (e.g., ../, %2e%2e%2f); unexpected outbound SSH connections from the n8n server to remote hosts.
• Logs: n8n application logs showing file transfer activity via SSH node with anomalous destination paths; web server access logs with POST requests to webhook endpoints containing encoded path traversal characters in filename fields.
• File System (Remote SSH Server): Unexpected modifications to ~/.ssh/authorized_keys; new or modified files in /etc/cron.d/, /etc/cron.hourly/, or other sensitive directories; web shells written to web-accessible directories.
• Process: Unexpected SSH login events from unknown IP addresses on remote systems connected to n8n via SSH credentials; new cron job executions spawning reverse shells or download utilities (curl, wget, bash).

The issue has been patched in n8n versions 1.123.12 (legacy branch) and 2.4.0 (v2.x branch); users should upgrade immediately (GitHub Advisory, n8n Security Advisory). If immediate upgrade is not possible, the following temporary mitigations should be applied:

• Disable or restrict access to workflows that accept file uploads via webhooks and transfer them via SSH.
• Enable webhook authentication on all endpoints that handle file uploads.
• Review and rotate SSH credentials used by n8n SSH nodes.
• Implement network segmentation to limit the blast radius of any compromised remote systems.

These workarounds do not fully remediate the risk and should only be used as short-term measures pending upgrade.

The Belgium Centre for Cybersecurity (CCB) issued an advisory warning about multiple critical vulnerabilities in n8n, including CVE-2026-25055 (CCB Advisory). Field Effect published a blog post noting the availability of a public PoC for the vulnerability (Field Effect). A Reddit thread in r/bugbounty discussed the vulnerability shortly after disclosure, and a Bluesky post from The Hacker Wire highlighted it to the security community. A Nuclei detection template was submitted to ProjectDiscovery's community repository, reflecting active interest from the security research community (Nuclei Templates PR).