CVE-2025-56265

An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.

Score

CVSS 3.1 8.8 High

Status

Analyzed - cve@mitre.org

Published

2025-09-08

Last modified

2025-09-08

Weaknesses

CWE-434

Affected products

• N8n (N8n)

References

• https://github.com/nikolas-ch/CVEs/blob/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload/StoredXSSv…
• https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1
• https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload