The browser_upload action interpreted a model-selected source path on the n8n server while the human approval described the outbound destination. The n8n AI Browser Use feature must be explicitly enabled and the agent must reach a file-upload step in its server-hosted Playwright session. An approved upload could transmit server-readable files rather than…
Inspect the ClaimsCase · DiggingBeagle record
n8n Browser Use accepted server paths as user-approved upload files
The browser_upload action interpreted a model-selected source path on the n8n server while the human approval described the outbound destination. An approved upload could transmit server-readable files rather than files belonging to the person requesting the task.
Scope
The n8n AI Browser Use feature must be explicitly enabled and the agent must reach a file-upload step in its server-hosted Playwright session. The advisory demonstrates a possible file exposure, not verified customer exfiltration or unrestricted access to all host directories.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: Human review of an upload destination does not authorize the source file.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-N8N-BROWSER-USE-SERVER-FILE-1 · CLM-ENRICH-20261029-19 · n8n Browser Use server-local file upload advisory
At a glance
An approved upload could transmit server-readable files rather than files belonging to the person requesting the task.
Read the implicationsThe advisory demonstrates a possible file exposure, not verified customer exfiltration or unrestricted access to all host directories.
Limits and uncertaintyFull account
The browser_upload action interpreted a model-selected source path on the n8n server while the human approval described the outbound destination.
The n8n AI Browser Use feature must be explicitly enabled and the agent must reach a file-upload step in its server-hosted Playwright session. An approved upload could transmit server-readable files rather than files belonging to the person requesting the task.
The advisory demonstrates a possible file exposure, not verified customer exfiltration or unrestricted access to all host directories. Upgrade to a fixed n8n release and bind approval to both the resolved source file and destination with server-side path restrictions.
Evidence interpretation and control boundary. Human review of an upload destination does not authorize the source file. The Browser Use tool resolved the model-chosen path on the server where Playwright ran, while the person approving the action might reasonably expect a file on their own machine. A useful fix must restrict server-readable source paths and bind approval to the exact source bytes and destination, not just display a domain name.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-19The n8n Browser Use advisory ties the upload source to the n8n server filesystem, under an opt-in AI Browser Use feature, and identifies fixed releases for that configuration-dependent disclosure path.supported
Basis: reported finding
- supportsn8n Browser Use server-local file upload advisoryprimary disclosure
GHSA-9qx8-fhxv-w794: browser_upload sourcePath, approval dialog, feature flag and fixed releases
CLM-CP23-N8N-BROWSER-USE-SERVER-FILE-1The browser_upload action interpreted a model-selected source path on the n8n server while the human approval described the outbound destination. The n8n AI Browser Use feature must be explicitly enabled and the agent must reach a file-upload step in its server-hosted Playwright session. An approved upload could transmit server-readable files rather than files belonging to the person requesting the task.supported
Basis: reported finding
- supportsn8n Browser Use server-local file upload advisoryprimary disclosure
GHSA-9qx8-fhxv-w794: browser_upload sourcePath, approval dialog, feature flag and fixed releases
Implications
An approved upload could transmit server-readable files rather than files belonging to the person requesting the task.
Controls and mitigations
- Upgrade to a fixed n8n release and bind approval to both the resolved source file and destination with server-side path restrictions.
Unknowns and contradictions
- The advisory demonstrates a possible file exposure, not verified customer exfiltration or unrestricted access to all host directories.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202