TI-2026-49946 CVE-2026-71279 · GHSA-77vh-g47p-vh46
Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution
Priority LOW 38
Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(b…