CVE-2026-72770 — n8n before 1.123.67 Path Traversal via Git Node Operations
n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-…
Published: 2026-08-11 · CVSS: 7.1 · CVSS 4.0
n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at local paths outside the sandbox to pull arbitrary git repositories and read their files and history.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7