Skip to main content

Improper Link Resolution Before File Access ('Link Following')

CVE-2025-57749

Medium
6.5/10

Summary

n8n is a workflow automation platform. through 1.105.4, a symlink traversal vulnerability was discovered in the "Read/Write" File node in n8n. While the node attempts to restrict access to sensitive directories and files, it does not properly account for symbolic links (symlinks). An attacker with the ability to create symlinks such as by using the Execute Command node could exploit this to bypass the intended directory restrictions and read from or write to otherwise inaccessible paths. Users of n8n.cloud are not impacted.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-59 - Improper Link Resolution Before File Access

'Improper link resolution before file access' occurs when software accesses a file resource but fails to verify that the file isn't a link or shortcut to another file. An attacker can potentially gain access to arbitrary files and from there the impact can vary, depending on the application, from sensitive data exposure to remote code execution.

References

Advisory Timeline

  • Published