CVE-2026-71279: Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution
Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a name parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves ../ sequences, a name such as ../../tmp/evil.js escapes the intended extensions directory. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import(), achieving remote code execution. Requires the enableexternaljs config option (off by default, but commonly enabled in legacy installs) and MQTT broker access, which is frequently unauthenticated in real deployments. The identical unsanitized getFilePath() is also used by the extension-removal handler, enabling arbitrary file deletion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the Zigbee2MQTT configuration option enable_external_js is disabled, since the External JS extension handler writes and dynamically imports unsanitized filenames received via MQTT.
Zigbee2MQTT External JS Extension enable_external_js = off (default) - Configuration
Patch Zigbee2MQTT ExternalJSExtension.getFilePath() to sanitize/validate the MQTT-provided name before using path.join(basePath, name), preventing traversal such as ../../tmp/evil.js that escapes the intended extensions directory.
Zigbee2MQTT ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) filename/path sanitization = validate & prevent path traversal (e.g., reject names containing ../ or leading /) - Configuration
Update the extension-removal handler that uses the identical unsanitized getFilePath() so it also rejects path traversal filenames, preventing arbitrary file deletion.
Zigbee2MQTT extension-removal handler same getFilePath() usage = sanitize/validate path traversal in removal path too - Compensating control
Restrict access to the MQTT broker and specifically the topic zigbee2mqtt/bridge/request/extension/save to authenticated/authorized clients only, since the extension name is received via MQTT and commonly is unauthenticated in real deployments.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71279?
The severity of CVE-2026-71279 is rated high with a score of 8.1.
How do I fix CVE-2026-71279?
To fix CVE-2026-71279, ensure to sanitize the 'name' parameter before it is used in the path.join() function.
What type of vulnerability is CVE-2026-71279?
CVE-2026-71279 is a Path Traversal vulnerability that can lead to remote code execution.
What software is affected by CVE-2026-71279?
The vulnerability affects Zigbee2MQTT, specifically in the ExternalJSExtension component.
What attack vector does CVE-2026-71279 use?
CVE-2026-71279 uses the MQTT messaging protocol to exploit an insecure method of handling file paths.