Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control

CVE-2026-21858 is a Content-Type confusion vulnerability in n8n webhook and file handling mechanism. The vulnerability exists in the parseRequestBody() function that routes requests based on Content-Type headers. When Content-Type is multipart/form-data, it uses parseFormData() storing data in req.body.files; otherwise uses parseBody() storing data in req.body. The flaw occurs when file-handling functions like copyBinaryFile() are called without verifying Content-Type is multipart/form-data, allowing attackers to control req.body.files object and manipulate filepath parameters to read arbitrary local files instead of uploaded files. The vulnerable flow is in formWebhook() function that invokes copyBinaryFile() to act on req.body.files without proper validation.