npm · n8n
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads
An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs, potentially exhausting available disk space on the host.
Users should upgrade to the patched version once available to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
uploadMaxFileSize to a low value to limit individual upload size.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.