CVE-2026-71279
Received Received - Intake

Path Traversal in Zigbee2MQTT Extension

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves `../` sequences, a name such as `../../tmp/evil.js` escapes the intended extensions directory. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import(), achieving remote code execution. Requires the `enable_external_js` config option (off by default, but commonly enabled in legacy installs) and MQTT broker access, which is frequently unauthenticated in real deployments. The identical unsanitized getFilePath() is also used by the extension-removal handler, enabling arbitrary file deletion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71279
EUVD
EUVD-2026-53364

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zigbee2mqtt zigbee2mqtt From 1.0.0 (inc)
koenkk zigbee2mqtt *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Zigbee2MQTT allows remote code execution due to improper path handling. The ExternalJSExtension.getFilePath() function joins a user-controlled 'name' parameter from an MQTT message into a base path without sanitization. Attackers can use path traversal sequences like '../../tmp/evil.js' to escape the intended directory and write files anywhere on the system. The file is then dynamically imported via Node.js, enabling arbitrary code execution.

Detection Guidance

Check if the enable_external_js config option is enabled in your Zigbee2MQTT configuration. Inspect MQTT messages on the zigbee2mqtt/bridge/request/extension/save topic for suspicious file paths containing ../ sequences. Review files in the extensions directory for unexpected .js/.mjs/.cjs files.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code on the system running Zigbee2MQTT. This could lead to full system compromise, data theft, or further network infiltration. The attack requires access to the MQTT broker, which is often unauthenticated in real deployments, making it easier to exploit. Additionally, the same vulnerability enables arbitrary file deletion via the extension removal handler.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules for protected health information. If exploited, it may result in data breaches, unauthorized modifications, or system disruptions, all of which are compliance violations requiring breach notifications and potential penalties.

Mitigation Strategies

Disable the enable_external_js option in your Zigbee2MQTT configuration. Restrict MQTT broker access to authenticated users only. Remove any unknown or suspicious files from the extensions directory. Update Zigbee2MQTT to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart