Arbitrary File Upload

🗓️ 15 Jan 2026 07:49:54Reported by Veracode Vulnerability DatabaseType

An arbitrary file upload flaw in the chat trigger lets attackers upload a crafted HTML file to execute code.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2025-56265	8 Sep 202519:15	–	circl
CNNVD	n8n 安全漏洞	8 Sep 202500:00	–	cnnvd
CVE	CVE-2025-56265	8 Sep 202500:00	–	cve
Cvelist	CVE-2025-56265	8 Sep 202500:00	–	cvelist
EUVD	EUVD-2025-27160	3 Oct 202520:07	–	euvd
Github Security Blog	N8N's Chat Trigger component is vulnerable to XSS	8 Sep 202518:31	–	github
NVD	CVE-2025-56265	8 Sep 202518:15	–	nvd
OSV	GHSA-V2X8-97XQ-8XRR N8N's Chat Trigger component is vulnerable to XSS	8 Sep 202518:31	–	osv
Positive Technologies	PT-2025-36488	8 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-56265	10 Sep 202500:34	–	redhatcve

Vulners

Node

Source	Link
github	www.github.com/nikolas-ch/CVEs/blob/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload/StoredXSSviaUnristrictedFileUpload.txt
github	www.github.com/n8n-io/n8n/pull/18148
github	www.github.com/n8n-io/n8n/commit/d4ef191be0b39b65efa68559a3b8d5dad2e102b2
github	www.github.com/n8n-io/n8n/releases/tag/n8n%401.107.0
github	www.github.com/n8n-io/n8n/commit/0f38370b42855ffa0ae2e41a834883361471365a
github	www.github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload
github	www.github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1
github	www.github.com/advisories/GHSA-v2x8-97xq-8xrr

22 Jun 2026 15:23Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.8

EPSS0.00557

SSVC