{"uuid": "e7d3e045-1d7d-4d9d-9ae3-b17f5093e692", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-q7m3-rhxg-7vxr", "type": "seen", "source": "https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8", "content": "# CVE-2026-54687: CVE-2026-54687: Path Traversal via User-Controlled Database File Path in n8n-nodes-sqlite3\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54687\n\n## Summary\nPrior to version 1.0.0, the n8n-nodes-sqlite3 integration exposed the db_path parameter as an unrestricted node parameter. By default, n8n node parameters allow the evaluation of dynamic data expressions, meaning untrusted external input could be mapped to the database path. This vulnerability allows an external attacker to control which SQLite database file the n8n backend process attempts to open, leading to directory traversal outside of the intended directory context.\n\n## TL;DR\nA path traversal vulnerability in n8n-nodes-sqlite3 prior to v1.0.0 allows remote attackers to read, create, or overwrite arbitrary database-compatible files via a manipulated db_path parameter.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **Attack Complexity**: High\n- **Privileges Required**: None\n- **User Interaction**: Passive\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept / Conceptual\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- n8n-nodes-sqlite3\n- **n8n-nodes-sqlite3**: < 1.0.0 (Fixed in: `1.0.0`)\n\n## Mitigation\n\n- Upgrade n8n-nodes-sqlite3 to version 1.0.0 or higher\n- Migrate to the credential-based V2 node architecture\n- Disable dynamic expression mapping on database paths\n\n**Remediation Steps:**\n1. Verify the current version of n8n-nodes-sqlite3 package.\n2. Execute npm update n8n-nodes-sqlite3 or update via the n8n community node interface.\n3. Rebuild workflows utilizing the SQLite node to adopt the V2 node definition.\n4. Ensure all db_path inputs are configured as static local paths and do not consume input from query, body, or header variables.\n\n## References\n\n- [Fix Commit](https://github.com/DangerBlack/n8n-node-sqlite3/commit/145a8876ff12375813bdcd4ae4fe78f460c53a98)\n- [Pull Request](https://github.com/DangerBlack/n8n-node-sqlite3/pull/25)\n- [GitHub Security Advisory](https://github.com/DangerBlack/n8n-node-sqlite3/security/advisories/GHSA-q7m3-rhxg-7vxr)\n- [Repository](https://github.com/DangerBlack/n8n-node-sqlite3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54687) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-27T22:31:50.894045Z"}