CVE-2026-15521 describes a path traversal vulnerability in makafeli n8n-workflow-builder versions 0.1 through 0.11.0. The vulnerability occurs in an unspecified function of build/server.cjs within the update_node_from_file component. By manipulating the filePath argument, an attacker with local access can perform path traversal, potentially accessing files outside the intended directory. The vulnerability was reported early to the project, but no response or fix has been issued. The CVSS 4.0 vector indicates low attack complexity and privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts.

An attacker with local access can exploit this vulnerability to traverse directories and potentially access or modify files outside the intended scope of the application. The impact is limited by the requirement for local access and the medium CVSS score reflects limited confidentiality, integrity, and availability impact.

No official patch or remediation is currently available from the vendor. Since the vulnerability requires local access, restrict local user permissions and monitor for unauthorized local activity. Check the vendor's advisory or project repository regularly for updates or patches addressing this issue.