Remote Code Execution in Zigbee2MQTT Due to Path Injection Vulnerability

CVE-2026-71279

What is CVE-2026-71279?

Zigbee2MQTT's ExternalJSExtension.getFilePath() method is susceptible to path injection vulnerabilities due to improper sanitization of user-supplied parameters. When an attacker sends a crafted MQTT message to the topic zigbee2mqtt/bridge/request/extension/save, the application uses the provided 'name' parameter without adequate validation, enabling directory traversal attacks. For example, inputs like '../../tmp/evil.js' can manipulate the file system, allowing attackers to execute arbitrary JavaScript code. This exploit can lead to remote code execution. Users should note that this vulnerability can be exploited if the 'enable_external_js' configuration is active, which is often the case in unpatched or legacy installations, combined with commonly unauthenticated MQTT broker access.

References