This vulnerability in makafeli n8n-workflow-builder up to version 0.11.0 involves improper handling of the filePath argument in the update_node_from_file component located in build/server.cjs. The flaw permits local attackers to perform path traversal, potentially accessing files outside the intended directory. The attack requires local access with low privileges and does not require user interaction. The vulnerability has been publicly disclosed with available exploit code, but no official remediation or patch has been provided by the vendor as of the publication date.

An attacker with local access and low privileges can exploit this vulnerability to traverse directories via the filePath argument, potentially reading or manipulating files outside the intended scope of the application. This could lead to unauthorized access to sensitive files or configuration data. However, the attack vector is limited to local access, and the overall impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for suspicious activity related to file operations in the affected component. Avoid running the affected versions in untrusted environments until a patch or official mitigation is available.