External risk intelligence

n8n-workflows Directory Traversal Vulnerability in Download Function

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-55526

The vulnerability exists in an API server function for a workflow collection. While APIs are often exposed, this specific component is a collection of user-contributed workflows rather than a standard, widely deployed internet-facing gateway or enterprise service, making public internet exposure plausible but not a standard deployment requirement.

Path Traversal

Zie619 N8n Workflow Collection

2025-06-29

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects n8n workflow collections, specifically impacting the download functionality. It allows for unauthorized access and manipulation of files on the server, which could potentially lead to significant data compromise or system disruption. The main concern is confirming whether our environment utilizes this specific component and is therefore exposed.

Directory traversal flaw in workflow downloads.
Confirm relevance and exposure of workflow collections.
Understand potential for data access and system impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the API server. This request would target the `download_workflow` function, which is susceptible to directory traversal. Successful exploitation could allow an attacker to access and potentially modify files on the server.

No authentication required.
Directory traversal via download function.
Unauthorized file access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to access or modify files on the server when the download_workflow function is called. The specific impact depends on the server's file system and the permissions of the n8n-workflows application.

Server files could be accessed.
Directory traversal via API call.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in the n8n-workflows download functionality likely falls under the responsibility of the platform or infrastructure teams managing the n8n deployment, with oversight from security teams. The immediate first step is to identify all instances of the affected n8n-workflows collection, determine their exposure and criticality, and then ascertain the specific application or workflow owner to plan remediation.

Platform/Infrastructure owns the issue.
Verify instance exposure and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is n8n-workflows?

n8n-workflows is a collection of user-contributed automation workflows built for the n8n platform. Users deploy these collections to extend n8n's capabilities, allowing them to automate tasks, connect services, and handle data processing within their local n8n environment.

What does CVE-2025-55526 mean for security?

This CVE represents a directory traversal vulnerability, classified as CWE-22. It means the software fails to properly sanitize file paths in the download_workflow function. An attacker can manipulate these paths to break out of the intended directory, gaining unauthorized access to read or modify files elsewhere on the underlying server.

How can an attacker trigger this vulnerability?

An attacker exploits this by sending a specially crafted, unauthenticated network request to the API server targeting the download_workflow function. This vulnerability is not triggered by standard, legitimate workflow usage; it requires the malicious manipulation of input parameters designed to navigate the server's file system structure.

Is my n8n-workflows installation at risk?

Halo Surface Signal indicates that while this component is not a standard, widely deployed enterprise gateway, its presence in an API server makes internet exposure possible. If your instance is reachable from the public internet, the risk is higher. You should assess whether your deployment uses the affected zie619 collection.

What should I do if I use this software?

First, locate all instances of the zie619 n8n_workflow_collection within your infrastructure. Once identified, verify if the service is exposed to the network and determine its business criticality. Finally, coordinate with the workflow owners to restrict access or apply updates as they become available to mitigate unauthorized file access.

References

github.com/Zie619/n8n-workflows/issues/48

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.