Skip to content
OpenAdvisories

Product · Koenkk

zigbee2mqtt

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-71279

    Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

    Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Th…

    Koenkk zigbee2mqtt