CVE-2026-72762 is a high severity (CVSS 8.8) arbitrary file write in the n8n Edit Image node. An authenticated user who can run workflows can write files outside the node's working directory. Upgrade to n8n 1.123.67, 2.31.5 or 2.32.1, or exclude the node.
What's affected
n8n before 1.123.67 on the 1.x line, 2.0.0 release candidates up to before 2.31.5, and 2.32.0 before 2.32.1, per the GitHub advisory, which rates it high. Fixed in 1.123.67, 2.31.5 and 2.32.1.
The weakness is CWE-434. The Edit Image node passed its output format parameter to the underlying image library without validation. A crafted value could write bytes to a location outside the node's working directory, so an authenticated user able to run workflows could write arbitrary files on the instance.
The record and the advisory agree on high severity. The attacker must be able to run workflows, so the exposure is mainly inside teams and shared instances.
How to check if you're exposed
Find the n8n version:
n8n --version
For Docker, read the image tag, and compare with the fixed versions.
Then check whether the node is in use and who can run workflows. Export the workflows and search for the node type:
n8n export:workflow --all --output=workflows.json
grep -c 'n8n-nodes-base.editImage' workflows.json
If the count is zero and you do not need the node, excluding it removes the exposure while you plan the upgrade. List the users with permission to create or run workflows, and confirm each still needs it.
free in-browser dependency scan checks manifests for known vulnerable versions of n8n.
What to do now
- Check the n8n version and upgrade to 1.123.67, 2.31.5 or 2.32.1.
- If you cannot upgrade yet, add n8n-nodes-base.editImage to the NODES_EXCLUDE environment variable, as the advisory suggests.
- Restrict n8n access to fully trusted users until patched.
- Review which users can create and run workflows.
- Check the instance file system for unexpected files if untrusted users had access.
Why it matters
CWE-434 is usually about uploads, but the effect here is a file write chosen by the caller. An output format parameter is treated as a harmless setting, yet the image library uses it to decide where and how to write. If it is not validated, it works as a path.
On an automation server, arbitrary file write is serious because the server holds credentials and runs code from workflows. Writing into the right location can turn into code execution. The advisory lists the file write itself as the impact, and the two workarounds it names, trusting only certain users and excluding the node, show where the real limit is: who can run workflows.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I block the node without upgrading?
Yes. The advisory says adding n8n-nodes-base.editImage to the NODES_EXCLUDE environment variable disables the node. Treat that as short term, and upgrade.
Sources
Last reviewed: 18 October 2026.
