Dorattias

**Name of the Vulnerable Software and Affected Versions** n8n versions 1.65.0 through 1.120.x **Description** A critical issue in the workflow automation platform allows unauthenticated remote attackers to gain full control over self-hosted instances. The flaw stems from a Content-Type mismatch in how the platform processes form-based webhook requests. Specifically, the middleware determines the parser based on the Content-Type header, but the Form Webhook Node fails to validate this header. An attacker can change the Content-Type from `multipart/form-data` to `application/json` and send a crafted payload to override the `req.body.files` object, including the file path. This enables arbitrary file reads, allowing attackers to access the local SQLite database and configuration files containing encryption secrets. By using these files, an attacker can forge an admin session cookie to authenticate without credentials and subsequently use the `Execute Command` node to achieve remote code execution. Approximately 100,000 servers worldwide are potentially affected. Real-world reconnaissance campaigns have been observed using a specialized user agent `n8n-scanner/1.0` to identify vulnerable endpoints via dictionary-based path enumeration. **Recommendations** Update n8n to version 1.121.0 or later. Restrict or disable publicly accessible webhook and form endpoints. Avoid exposing the instance directly to the internet without a VPN or additional authentication. Require authentication on all public forms. Rotate all stored credentials and API keys if a prior compromise is suspected.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 2.2.5 **Description** An unauthenticated arbitrary file upload issue exists when `storageType` is set to local. This allows attackers to use path traversal—a technique used to access files and directories outside the intended folder—via the `chatId` and `chatflowId` parameters in the '/api/v1/attachments' endpoint. This can lead to the upload of malicious files to arbitrary directories, potentially resulting in remote code execution and full server compromise. **Recommendations** Update Flowise to version 2.2.5 or later. As a temporary mitigation, avoid setting `storageType` to local or restrict access to the '/api/v1/attachments' endpoint.

**Name of the Vulnerable Software and Affected Versions** FlowiseAI Flowise version 2.2.6 **Description** FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the `/api/v1/attachments` API endpoint. This allows unauthenticated users to upload malicious files, potentially leading to remote code execution and server takeover. Reports indicate over 20,000 potentially affected instances. The vulnerability is actively exploited. **Recommendations** Upgrade to version 2.2.7 or later to address this vulnerability.