{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71279", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T12:23:34.967Z", "datePublished": "2026-08-05T12:26:25.594Z", "dateUpdated": "2026-08-05T15:55:11.665Z"}, "containers": {"cna": {"title": "Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution", "descriptions": [{"lang": "en", "value": "Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves `../` sequences, a name such as `../../tmp/evil.js` escapes the intended extensions directory. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import(), achieving remote code execution. Requires the `enable_external_js` config option (off by default, but commonly enabled in legacy installs) and MQTT broker access, which is frequently unauthenticated in real deployments. The identical unsanitized getFilePath() is also used by the extension-removal handler, enabling arbitrary file deletion."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "Koenkk", "product": "zigbee2mqtt", "programFiles": ["lib/extension/externalJS.ts"], "versions": [{"version": "0", "lessThanOrEqual": "2.12.0", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/Koenkk/zigbee2mqtt"}, {"url": "https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts"}], "credits": [{"lang": "en", "value": "Alibek Baxtiyorov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-05T12:26:25.594Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:55:04.507481Z", "id": "CVE-2026-71279", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:55:11.665Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71279", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:55:04.507481Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:55:07.728Z"}}], "cna": {"title": "Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution", "credits": [{"lang": "en", "type": "finder", "value": "Alibek Baxtiyorov"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Koenkk", "product": "zigbee2mqtt", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.12.0"}], "programFiles": ["lib/extension/externalJS.ts"], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/Koenkk/zigbee2mqtt"}, {"url": "https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts"}], "descriptions": [{"lang": "en", "value": "Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves `../` sequences, a name such as `../../tmp/evil.js` escapes the intended extensions directory. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import(), achieving remote code execution. Requires the `enable_external_js` config option (off by default, but commonly enabled in legacy installs) and MQTT broker access, which is frequently unauthenticated in real deployments. The identical unsanitized getFilePath() is also used by the extension-removal handler, enabling arbitrary file deletion."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-05T12:26:25.594Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71279", "state": "PUBLISHED", "dateUpdated": "2026-08-05T15:55:11.665Z", "dateReserved": "2026-08-05T12:23:34.967Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T12:26:25.594Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{}

{}

{"created": "2026-08-05T15:30:17.151862+00:00", "updated": "2026-08-05T15:30:17.151868+00:00", "vendors": []}