Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck

CVE-2026-58661n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint

Medium 5.3

In plain English

A medium-severity resource allocation without limits in n8n from n8n. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	n8n	2.28.0	GHSA-w867-jm58-p9pv
npm	n8n	1.123.58	GHSA-w867-jm58-p9pv

Affected products (as reported)

Vendor	Product	Versions
n8n	n8n	2.0.0 – before 2.28.0
n8n	n8n	0 – before 1.123.58

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-w867-jm58-p9pv) vendor-advisory
VulnCheck Advisory: n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint third-party-advisory