---
id: CVE-2026-58661
title: n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint
summary: >-
  n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk
  space exhaustion vulnerability in the data-table file upload endpoint. The
  per-request quota check does not account for files already written to the
  shared tempora…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-770
vendor: n8n
product: n8n
affected:
  - n8n >= 2.0.0 < 2.28.0
  - n8n < 1.123.58
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-10T16:43:17.458913Z'
published: '2026-07-10'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:16:02.900Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58661'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv'
    label: GitHub Security Advisory (GHSA-w867-jm58-p9pv)
  - url: >-
      https://www.vulncheck.com/advisories/n8n-disk-space-exhaustion-via-data-table-file-upload-endpoint
    label: >-
      VulnCheck Advisory: n8n - Disk Space Exhaustion via Data-Table File Upload
      Endpoint
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58661'
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.58'
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.28.0'
  - url: 'https://github.com/advisories/GHSA-w867-jm58-p9pv'
tags:
  - cve.org
  - ghsa
  - npm
epss: 0.00386
epssPercentile: 0.32857
aliases:
  - GHSA-w867-jm58-p9pv
ecosystem: npm
patched:
  - n8n 2.28.0
  - n8n 1.123.58
ingestedAt: '2026-07-22T23:07:32.697Z'
---

## Overview

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly upload files that accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.

## Affected

- `n8n >= 2.0.0 < 2.28.0`
- `n8n < 1.123.58`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-58661)

Affected packages:

- `n8n >= 2.0.0, < 2.28.0`
- `n8n < 1.123.58`

Patched in:

- `n8n 2.28.0`
- `n8n 1.123.58`

Source: https://github.com/advisories/GHSA-w867-jm58-p9pv