| Package | Affected versions | Patched versions |
|---|---|---|
| n8n | ≥ 2.0.0, < 2.28.0< 1.123.58 | 2.28.01.123.58 |
| n8n | ≥ 2.0.0, < 2.28.0< 1.123.58 | 2.28.01.123.58 |
An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
Users should upgrade to the patched version once available to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
uploadMaxFileSize to a low value to limit individual upload size.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free