CVE-2026-71279

Name of the Vulnerable Software and Affected Versions Zigbee2MQTT (affected versions not specified)

Description An issue exists in the ExternalJSExtension.getFilePath() function within lib/extension/externalJS.ts where a name parameter received via the MQTT topic zigbee2mqtt/bridge/request/extension/save is joined to the extensions base path using path.join() without proper sanitization. Because path.join() resolves ../ sequences, an attacker can use a path like ../../tmp/evil.js to escape the intended directory. The system only validates that the file ends in .js, .mjs, or .cjs before writing and dynamically importing it via Node.js import(), leading to remote code execution. This requires the enable external js configuration option to be active and access to the MQTT broker. Additionally, the same unsanitized getFilePath() function is used by the extension-removal handler, which allows for arbitrary file deletion.

Recommendations Disable the enable external js configuration option to prevent the execution of external JavaScript files. Restrict access to the MQTT broker to ensure only authorized users can send messages to the bridge. At the moment, there is no information about a newer version that contains a fix for this vulnerability.