CVE-2026-54687: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in DangerBlack n8n-node-sqlite3
Description
CVE-2026-54687 is a path traversal vulnerability in the DangerBlack n8n-node-sqlite3 node prior to version 1.0.0. The vulnerability arises because the db_path parameter, which specifies the SQLite database file path, can be controlled by untrusted workflow input. This allows an attacker to cause the n8n process to open arbitrary files outside the intended database directory, potentially leading to unauthorized reading, creation, or overwriting of files accessible to the process. The issue is fixed in version 1.0.0.
CVSS v4.0
Score 6.1medium
Affected software
DangerBlack
n8n-node-sqlite3
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The n8n-node-sqlite3 node before version 1.0.0 exposes the db_path parameter as a node input that can be influenced by upstream workflow data. This improper limitation of pathname to a restricted directory (CWE-22) enables a remote attacker who can control workflow input to perform path traversal attacks. By manipulating db_path, the attacker can cause the n8n process to open arbitrary SQLite files or other files accessible to the process, potentially leading to unauthorized file access or modification. The vulnerability has a CVSS 4.0 score of 6.1 (medium severity) and is fixed in version 1.0.0.
Potential Impact
An attacker who can supply untrusted input to the db_path parameter in a workflow can cause the n8n process to open arbitrary files outside the intended database location. This can lead to unauthorized reading, creation, or overwriting of files accessible to the process, potentially compromising data confidentiality and integrity within the scope of the n8n process permissions.
Mitigation Recommendations
Upgrade to n8n-node-sqlite3 version 1.0.0 or later, where this path traversal vulnerability is fixed. Until upgraded, avoid mapping untrusted input to the db_path parameter to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T22:53:58.561Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a909cf4acd9273b49b2cdd2
Added to database: 08/27/2026, 20:24:20 UTC
Last enriched: 09/10/2026, 04:24:17 UTC
Last updated: 10/10/2026, 06:48:17 UTC
Views: 32
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.