CVE-2026-15521 | A vulnerability was identified in makafeli n8n-workflow-buil… | CVSS 5.3 MEDIUM

Description

A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component update_node_from_file. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Metadata

CVE ID: CVE-2026-15521
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-12 11:35 UTC
Published: 2026-07-13 01:30 UTC
Last updated: 2026-07-13 01:30 UTC
Primary CWE: CWE-22
Path Traversal
Vendor / Product: makafeli / n8n-workflow-builder
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
makafeli	n8n-workflow-builder	—	0.1, 0.2, 0.3, 0.4 …

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	Path Traversal

CVSS scores (4)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	3.0	cna	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
4.8	MEDIUM	4.0	cna	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
4.3	N/D	2.0	cna	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

References (6)

VDB-377850 | makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal https://vuldb.com/vuln/377850
VDB-377850 | CTI Indicators (IOB, IOC, TTP, IOA) https://vuldb.com/vuln/377850/cti
CVE-2026-15521 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-15521
Submit #854522 | makafeli n8n-workflow-builder 0.11.0 Path Traversal https://vuldb.com/submit/854522
https://github.com/makafeli/n8n-workflow-builder/issues/28
https://github.com/makafeli/n8n-workflow-builder/