CVE-2026-54687: n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)
Affected versions < 1.0.0
Patched version 1.0.0
Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to control which file was opened by SQLite, potentially enabling path traversal to read or overwrite arbitrary files accessible to the n8n process.
The vulnerability requires the workflow author to explicitly wire untrusted input to the dbpath parameter, so it does not affect standalone deployments where only trusted users author workflows. However, in multi-tenant or user-facing n8n deployments the risk is elevated.
Fixed in v1.0.0 by moving the database path into a credential (v2 node architecture), which is stored server-side and not controllable by workflow input data.
References - Fix commit: 145a887 - Introduced credential-based path: v2 node
Credits dyingman1 (role: Reporter)
Other sources
n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpath can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8n-nodes-sqlite3to a version that resolves this vulnerability.Fixed in 1.0.0 - Upgrade
Upgrade
n8n-nodes-sqlite3to a version that resolves this vulnerability.Fixed in 1.0.0Patch 145a887 - Compensating control
For n8n versions prior to 1.0.0, ensure workflow authors do not map untrusted workflow input/data expressions into the SQLite node's db_path parameter, since nodes/SqliteNode/v1/SqliteV1.node.ts exposes db_path as an editable node parameter.
Event History
Frequently Asked Questions
Which deployments are most exposed?
Multi-tenant or user-facing n8n deployments are at elevated risk when workflow authors can map untrusted user input into the SQLite node's db_path field. Standalone deployments in which only trusted users author workflows are not affected by this condition.
What must an attacker control to exploit this issue?
A workflow author must explicitly wire untrusted input to the db_path parameter. An attacker who can influence that input may then control the file path opened by SQLite, including through path traversal, subject to the files accessible to the n8n process.
What should be done if upgrading cannot happen immediately?
Do not map untrusted input to the SQLite node's db_path parameter, and restrict workflow authoring to trusted users. This prevents workflow input data from controlling the database file path.
How does version 1.0.0 address the issue?
Version 1.0.0 moves the database path into a server-side credential using the v2 node architecture. The path is no longer controllable through workflow input data.