CVE-2026-71279

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71279
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71279.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71279
Published
2026-08-05T12:26:25.594Z
Modified
2026-08-07T03:46:54.317874824Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution
Details

Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a name parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves ../ sequences, a name such as ../../tmp/evil.js escapes the intended extensions directory. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import(), achieving remote code execution. Requires the enable_external_js config option (off by default, but commonly enabled in legacy installs) and MQTT broker access, which is frequently unauthenticated in real deployments. The identical unsanitized getFilePath() is also used by the extension-removal handler, enabling arbitrary file deletion.

Database specific 
{
    "cna_assigner": "TuranSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71279.json",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/koenkk/zigbee2mqtt

Affected ranges

Type
GIT
Repo
https://github.com/koenkk/zigbee2mqtt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fd8bafc81d03aa401f41eba5803a3dd1dd8092cd
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.12.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.2.0
1.*
1.0.0
1.1.0
1.10.0
1.11.0
1.12.0
1.12.1
1.13.0
1.13.1
1.14.0
1.14.1
1.14.2
1.14.4
1.15.0
1.16.0
1.16.2
1.17.0
1.17.1
1.18.0
1.18.1
1.18.2
1.18.3
1.19.0
1.2.0
1.20.0
1.21.0
1.21.1
1.21.2
1.22.0
1.22.1
1.22.2
1.23.0
1.24.0
1.25.0
1.25.1
1.25.2
1.26.0
1.27.0
1.27.1
1.27.2
1.28.0
1.28.1
1.28.3
1.28.4
1.29.0
1.29.1
1.29.2
1.3.0
1.30.0
1.30.2
1.30.3
1.30.4
1.31.0
1.32.0
1.32.2
1.33.0
1.33.1
1.33.2
1.34.0
1.35.0
1.35.1
1.35.2
1.35.3
1.36.0
1.36.1
1.37.0
1.37.1
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.40.1
1.40.2
1.41.0
1.42.0
1.5.0
1.5.1
1.6.0
1.7.0
1.7.1
1.8.0
1.9.0
2.*
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.10.0
2.10.1
2.11.0
2.12.0
2.2.0
2.2.1
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.1
2.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71279.json"