Path Traversal Vulnerability in n8n Git Node Operations

CVE-2026-72770

What is CVE-2026-72770?

Versions of n8n prior to 1.123.67 exhibit a path traversal vulnerability within the Git node's operations, including fetch, pull, and push-tags. This flaw allows authenticated users, particularly those with rights to create or execute workflows, to circumvent repository-path containment checks. By exploiting this vulnerability, they can direct allowlisted remote configurations at local paths outside of the designated sandbox environment. This may lead to the exposure and retrieval of arbitrary Git repositories as well as their associated files and history.

References