CVE-2026-21858

COMPONENT VERSION RANGE

NewScan fingerprints n8n from its response and reports this CVE when the detected version falls inside the affected range below.

Range taken from the VENDOR advisory GHSA-v4pr-fm98-w9pg (affected >= 1.65.0 < 1.121.0, patched 1.121.0), not from a write-up. Proof pair: affected = training/cve vulhub n8n/CVE-2026-21858 (1.65.0), fixed = training/good/n8n (n8nio/n8n:latest, measured 2.29.9). formWebhook() calls prepareFormReturnItem()/copyBinaryFile() without checking the request is multipart/form-data, so a JSON body controls `filepath` and the server returns the file. Unauthenticated, and chainable with CVE-2025-68613 to RCE - which is why scan_n8n reports it on the version alone and never attempts the read against a customer.