Vulnerability · Published Aug 5, 2026 · Assigned by TuranSec

CVE-2026-71279Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

High 8.1

In plain English

A high-severity path traversal in zigbee2mqtt from Koenkk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 52.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Koenkk	zigbee2mqtt	0 – through 2.12.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Koenkk/zigbee2mqtt third-party-advisory
https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts third-party-advisory