CVE-2025-56265: Malicious File Upload
Published Sep 8, 2025
·Updated
An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.
Affected Software
5 affected componentsFixes available
n8n n8n=1.95.3, =1.100.1, =1.101.1
npm/@n8n/n8n-nodes-langchain<1.107.0
1.107.0
n8n N8n Node.js=1.95.3
n8n N8n Node.js=1.100.1
n8n N8n Node.js=1.101.1
Event History
Sep 8, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:31 PM
Data Sourced
via GitHub·06:31 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-56265?
CVE-2025-56265 is classified as a high severity vulnerability due to its potential to allow remote code execution.
2
How do I fix CVE-2025-56265?
To fix CVE-2025-56265, upgrade N8N to versions later than 1.101.1 where the vulnerability has been patched.
3
Who is affected by CVE-2025-56265?
CVE-2025-56265 affects users running N8N versions 1.95.3, 1.100.1, and 1.101.1.
4
What does CVE-2025-56265 allow attackers to do?
CVE-2025-56265 allows attackers to upload a crafted HTML file that can execute arbitrary code on the server.
5
Is there a workaround for CVE-2025-56265?
Currently, the recommended workaround for CVE-2025-56265 is to disable the Chat Trigger component until a patch is applied.