CVE-2026-54687: CVE-2026-54687: Path Traversal via User-Controlled Database File Path in n8n-nodes-sqlite3

#security #cve #cybersecurity

CVE-2026-54687: Path Traversal via User-Controlled Database File Path in n8n-nodes-sqlite3

Vulnerability ID: CVE-2026-54687
CVSS Score: 6.1
Published: 2026-08-27

Prior to version 1.0.0, the n8n-nodes-sqlite3 integration exposed the db_path parameter as an unrestricted node parameter. By default, n8n node parameters allow the evaluation of dynamic data expressions, meaning untrusted external input could be mapped to the database path. This vulnerability allows an external attacker to control which SQLite database file the n8n backend process attempts to open, leading to directory traversal outside of the intended directory context.

TL;DR

A path traversal vulnerability in n8n-nodes-sqlite3 prior to v1.0.0 allows remote attackers to read, create, or overwrite arbitrary database-compatible files via a manipulated db_path parameter.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: Passive
EPSS Score: N/A
Exploit Status: Proof-of-Concept / Conceptual
KEV Status: Not Listed

Affected Systems

n8n-nodes-sqlite3
n8n-nodes-sqlite3: < 1.0.0 (Fixed in: 1.0.0)

Code Analysis

Commit: 145a887

Fix path traversal vulnerability in SQLite V1 node parameter by setting noDataExpression to true

@@ -115,6 +115,7 @@ export class SqliteV1 implements INodeType {
                placeholder: '/path/to/database.sqlite',
                description: "'The path to the SQLite database file',"
                required: true,
+               noDataExpression: true,
            },
            {
                displayName: 'Query Type',

Mitigation Strategies

Upgrade n8n-nodes-sqlite3 to version 1.0.0 or higher
Migrate to the credential-based V2 node architecture
Disable dynamic expression mapping on database paths

Remediation Steps:

Verify the current version of n8n-nodes-sqlite3 package.
Execute npm update n8n-nodes-sqlite3 or update via the n8n community node interface.
Rebuild workflows utilizing the SQLite node to adopt the V2 node definition.
Ensure all db_path inputs are configured as static local paths and do not consume input from query, body, or header variables.

References

Read the full report for CVE-2026-54687 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community