CVE-2026-71269
Received Received - Intake

Path Traversal in Node-RED Local Filesystem Storage

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification. An authenticated user (including read-only-scoped tokens for the read path) can supply a path containing `../` sequences to read arbitrary files outside the library directory; a user with write access can write arbitrary files, enabling remote code execution via SSH authorized_keys or cron injection. This is a distinct, separately unpatched traversal from the previously fixed CVE-2021-21298 (Projects API).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71269
EUVD
EUVD-2026-53354

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
node-red local-filesystem *
node-red node-red From 2021-12-01 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Node-RED allows authenticated users to access or modify files outside the intended library directory by exploiting path traversal via the GET/POST /library/:lib/:type/*path endpoint. The user-supplied path parameter is directly joined to the filesystem path without sanitization, enabling directory traversal attacks using sequences like ../. Read-only users can read arbitrary files, while users with write access can write files, potentially leading to remote code execution.

Detection Guidance

Check Node-RED logs for suspicious GET/POST requests to /library/:lib/:type/*path endpoints. Inspect filesystem access patterns outside the expected library directories. Use tools like grep to search for '../' sequences in URL paths or filesystem operations.

Impact Analysis

An attacker with access could read sensitive files like configuration files or credentials, or write malicious files to execute arbitrary code. This could lead to system compromise, data theft, or unauthorized access. The impact depends on the user's permissions; read-only users face information disclosure, while write-enabled users face full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security rules for protected health information. It may result in data breaches, non-compliance penalties, and loss of trust due to inadequate access controls and file handling.

Mitigation Strategies

Upgrade Node-RED to the latest patched version immediately. Restrict access to /library endpoints via firewall rules. Disable write access for read-only users. Monitor filesystem writes outside library directories. Apply least-privilege principles to user tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart