CVE-2026-72773 describes a path traversal vulnerability in the n8n automation tool's file-search component (@n8n/computer-use). The vulnerability arises because the search_files tool improperly limits pathnames to a restricted directory, allowing crafted inputs to escape the base directory confinement. This results in the tool returning names and contents of arbitrary local files accessible by the daemon's operating system user. The issue affects n8n versions prior to 2.31.5 and versions 2.32.x before 2.32.1. Exploitation requires the ability to influence the search input to the tool.

An attacker able to control the search input can bypass directory restrictions and read arbitrary local files accessible by the n8n daemon user. This could lead to unauthorized disclosure of sensitive information stored on the host system. The CVSS 4.0 base score is 4.9 (medium severity), reflecting network attack vector with low complexity and partial privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the file-search tool's input to trusted users only and monitor for suspicious usage patterns. Avoid exposing the vulnerable functionality to untrusted actors.