n8n Chained Arbitrary File Read to Sandbox-Bypass RCE via Form File Upload (CVE-2026-21858/CVE-2025-68613)

Duo Tech@duotech

•updated Jul 30, 2026•0•0•5

Detects an n8n form file-upload request combining the vulnerable /form/ multipart upload endpoint with a path-traversal marker in the filename field, consistent with the chained CVE-2026-21858 arbitrary file read to CVE-2025-68613 sandbox-bypass RCE exploit.