Vulnerability Description
Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves `../` sequences, a name such as `../../tmp/evil.js` escapes the intended extensions directory. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import(), achieving remote code execution. Requires the `enable_external_js` config option (off by default, but commonly enabled in legacy installs) and MQTT broker access, which is frequently unauthenticated in real deployments. The identical unsanitized getFilePath() is also used by the extension-removal handler, enabling arbitrary file deletion.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Koenkk/zigbee2mqtt
- https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts
FAQ
What is CVE-2026-71279?
CVE-2026-71279 is a vulnerability with a CVSS score of 8.0 (HIGH). Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extension...
How severe is CVE-2026-71279?
CVE-2026-71279 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-71279?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.