Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
Platforms
1
Products / Services
1
1
1
1
1
MITRE Techniques
2
1
1
1
1
CVEs
71
71
64
58
49
IDS Classtypes
1
IDS Protocols
1
Detects an n8n form file-upload request combining the vulnerable /form/ multipart upload endpoint with a path-traversal marker in the filename field, consistent with the chained CVE-2026-21858 arbitrary file read to CVE-2025-68613 sandbox-bypass RCE exploit.
Detects HTTP POST requests to n8n '/form/*' endpoints where the Content-Type header is 'application/json'. This indicates an attempt to exploit the Content-Type confusion vulnerability (CVE-2026-21858) to achieve arbitrary file read and subsequent remote code execution.
