CVE-2026-71279

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71279", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T12:23:34.967Z", "datePublished": "2026-08-05T12:26:25.594Z", "dateUpdated": "2026-08-10T11:47:00.480Z"}, "containers": {"cna": {"title": "Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution", "descriptions": [{"lang": "en", "value": "Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "Koenkk", "product": "zigbee2mqtt", "programFiles": ["lib/extension/externalJS.ts"], "versions": [{"version": "0", "lessThanOrEqual": "2.12.0", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/Koenkk/zigbee2mqtt", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Alibek Baxtiyorov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:00.480Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T12:26:25.594Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:55:04.507481Z", "id": "CVE-2026-71279", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:55:11.665Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71279", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:55:04.507481Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:55:07.728Z"}}], "cna": {"title": "Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alibek Baxtiyorov"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Koenkk", "product": "zigbee2mqtt", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.12.0"}], "programFiles": ["lib/extension/externalJS.ts"], "defaultStatus": "unaffected"}], "datePublic": "2026-08-05T12:26:25.594Z", "references": [{"url": "https://github.com/Koenkk/zigbee2mqtt", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.", "supportingMedia": [{"type": "text/html", "value": "<p>Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:00.480Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71279", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:47:00.480Z", "dateReserved": "2026-08-05T12:23:34.967Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T12:26:25.594Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "zigbee2mqtt", "programFiles": ["lib/extension/externalJS.ts"], "vendor": "Koenkk", "versions": [{"lessThanOrEqual": "2.12.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution."}, {"lang": "es", "value": "ExternalJSExtension.getFilePath() de Zigbee2MQTT (lib/extensi\u00f3n/externalJS.ts) une un par\u00e1metro \u2019name\u2019 recibido a trav\u00e9s de un mensaje MQTT (tema zigbee2mqtt/bridge/request/extensi\u00f3n/save) en la ruta base de las extensiones usando path.join(basePath, name) sin sanitizaci\u00f3n. Debido a que path.join() resuelve secuencias \u2019.. / \u2019, un nombre como \u2019.. / .. / tmp/evil.js\u2019 escapa del directorio de extensiones previsto. El gestor de extensiones solo valida que el nombre termine en .js/.mjs/.cjs, escribe el archivo y luego lo importa din\u00e1micamente a trav\u00e9s de Node.js import(), logrando ejecuci\u00f3n remota de c\u00f3digo. Requiere la opci\u00f3n de configuraci\u00f3n \u2019enable_external_js\u2019 (desactivada por defecto, pero com\u00fanmente habilitada en instalaciones heredadas) y acceso al broker MQTT, que con frecuencia no est\u00e1 autenticado en implementaciones reales. El id\u00e9ntico getFilePath() no sanitizado tambi\u00e9n es utilizado por el gestor de eliminaci\u00f3n de extensiones, permitiendo la eliminaci\u00f3n arbitraria de archivos."}], "id": "CVE-2026-71279", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71279", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T15:55:04.507481Z", "version": "2.0.3"}}]}, "published": "2026-08-05T13:24:52.437", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/Koenkk/zigbee2mqtt"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.12.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "zigbee2mqtt", "source": "cna", "vendor": "Koenkk"}, "product": "zigbee2mqtt", "vendor": "koenkk"}], "created": "2026-08-05T15:30:17.151862+00:00", "updated": "2026-08-10T21:30:04.094938+00:00", "vendors": ["koenkk", "koenkk$PRODUCT$zigbee2mqtt"]}