Path Traversal Vulnerability in Node-RED's Local Filesystem Module

CVE-2026-71269

What is CVE-2026-71269?

The local-filesystem storage module in Node-RED is susceptible to a path traversal vulnerability, where user-supplied path parameters are not properly sanitized. This allows authenticated users to exploit the lack of containment checks and path normalization, leading to unauthorized access to files outside the designated library directory. A user with write permissions can even inject arbitrary files, potentially leading to remote code execution through SSH authorized_keys or cron tasks. This vulnerability poses significant risks, especially for applications that rely on secure library access.

References