CVE-2026-71279 Koenkk CVE debrief

Who should care

Organizations using Zigbee2MQTT with the enable_external_js config option enabled should prioritize patching to prevent remote code execution and arbitrary file deletion attacks. Additionally, organizations should review their MQTT broker access controls and ensure that they are properly configured to prevent unauthorized access. Security teams should also monitor for suspicious MQTT messages and review system logs for any signs of malicious activity. Vulnerability management teams should assess the affected scope and prioritize patching accordingly. Platform operators should ensure that their systems are up-to-date and patched to prevent exploitation. Asset inventory teams should review their asset lists to identify potentially affected systems. Compensating controls, such as monitoring and detection, should be implemented while remediation is scheduled and verified. Rollback/change windows should be planned to minimize downtime. Source tracking should be implemented to monitor for potential exploitation attempts. Exposure review should be conducted to identify potential vulnerabilities. Vendor patch guidance should be followed to ensure proper patching. Monitoring and detection should be implemented to identify potential exploitation attempts. Asset inventory should be reviewed to identify potentially affected systems. Compensating controls should be implemented to prevent exploitation while remediation is scheduled and verified. Rollback/change windows should be planned to minimize downtime. Source tracking should be implemented to monitor for potential exploitation attempts. Exposure review should be conducted to identify potential vulnerabilities. Vendor patch guidance should be followed to ensure proper patching. Monitoring and detection should be implemented to identify potential exploitation attempts. Asset inventory should be reviewed to identify potentially affected systems. Compensating controls should be implemented to prevent exploitation while remediation is scheduled and verified. Rollback/change windows should be planned to minimize downtime. Source tracking should be implemented to monitor for potential exploitation attempts. Exposure review sh

Technical summary

Zigbee2MQTT's ExternalJSExtension.getFilePath() function is vulnerable to path traversal attacks, allowing for remote code execution and arbitrary file deletion when the enable_external_js config option is enabled. This vulnerability is due to the lack of sanitization of the name parameter received via an MQTT message, which can be exploited to escape the intended extensions directory. The vulnerability requires MQTT broker access, which is frequently unauthenticated in real deployments.

Defensive priority

Organizations using Zigbee2MQTT with the enable_external_js config option enabled should prioritize patching, as this vulnerability allows for remote code execution and arbitrary file deletion.

Recommended defensive actions

• Patch Zigbee2MQTT installations with enable_external_js config option enabled
• Disable enable_external_js config option if not required
• Verify MQTT broker access controls
• Monitor for suspicious MQTT messages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Conduct exposure review to identify potential vulnerabilities

Evidence notes

The CVE description indicates that Zigbee2MQTT's ExternalJSExtension.getFilePath() function is vulnerable to path traversal attacks, allowing for remote code execution and arbitrary file deletion when the enable_external_js config option is enabled. To verify, defenders should review the configuration of their Zigbee2MQTT installations, check for any suspicious MQTT messages, and ensure that the enable_external_js config option is disabled if not required. Additionally, defenders should monitor for potential exploitation attempts and review the system's logs for any signs of malicious activity.

Official resources