CVE-2026-71279

Received Received - Intake

Path Traversal in Zigbee2MQTT Extension

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-71279

EUVD

EUVD-2026-53364

Affected Vendors & Products

Vendor	Product	Version / Range
zigbee2mqtt	zigbee2mqtt	From 1.0.0 (inc)
koenkk	zigbee2mqtt	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in Zigbee2MQTT allows remote code execution due to improper path handling. The ExternalJSExtension.getFilePath() function joins a user-controlled 'name' parameter from an MQTT message into a base path without sanitization. Attackers can use path traversal sequences like '../../tmp/evil.js' to escape the intended directory and write files anywhere on the system. The file is then dynamically imported via Node.js, enabling arbitrary code execution.

Detection Guidance

Check if the enable_external_js config option is enabled in your Zigbee2MQTT configuration. Inspect MQTT messages on the zigbee2mqtt/bridge/request/extension/save topic for suspicious file paths containing ../ sequences. Review files in the extensions directory for unexpected .js/.mjs/.cjs files.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code on the system running Zigbee2MQTT. This could lead to full system compromise, data theft, or further network infiltration. The attack requires access to the MQTT broker, which is often unauthenticated in real deployments, making it easier to exploit. Additionally, the same vulnerability enables arbitrary file deletion via the extension removal handler.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules for protected health information. If exploited, it may result in data breaches, unauthorized modifications, or system disruptions, all of which are compliance violations requiring breach notifications and potential penalties.

Mitigation Strategies

Disable the enable_external_js option in your Zigbee2MQTT configuration. Restrict MQTT broker access to authenticated users only. Remove any unknown or suspicious files from the extensions directory. Update Zigbee2MQTT to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-71279. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70