Medium, CVSS 6.1npmPublished
n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
CVE-2026-54687 · GHSA-q7m3-rhxg-7vxr
- Affected
- npm n8n-nodes-sqlite3 < 1.0.0
- Fixed in
- 1.0.0· Vendor fix available
- Issue
- Affected versions < 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to control which file was opened by SQLite, potentially enabling path traversal to read or overwrite arbitrary files accessible to the n8n process. The vulnerability requires the workflow author to explicitly wire untrusted input to the dbpath parameter, so it does not affect standalone deployments where only trusted users author workflows. However, in multi-tenant or user-facing n8n deployments the risk is elevated. Fixed in v1.0.0 by moving the database path into a credential (v2 node architecture), which is stored server-side and not controllable by workflow input data. References - Fix commit: 145a887 - Introduced credential-based path: v2 node Credits dyingman1 (role: Reporter)
Recommended action: Upgrade to 1.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.