CVE-2025-56265: Malicious File Upload
An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@n8n/n8n-nodes-langchainto a version that resolves this vulnerability.Fixed in 1.107.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56265?
CVE-2025-56265 is classified as a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2025-56265?
To fix CVE-2025-56265, upgrade N8N to versions later than 1.101.1 where the vulnerability has been patched.
Who is affected by CVE-2025-56265?
CVE-2025-56265 affects users running N8N versions 1.95.3, 1.100.1, and 1.101.1.
What does CVE-2025-56265 allow attackers to do?
CVE-2025-56265 allows attackers to upload a crafted HTML file that can execute arbitrary code on the server.
Is there a workaround for CVE-2025-56265?
Currently, the recommended workaround for CVE-2025-56265 is to disable the Chat Trigger component until a patch is applied.