PatchSiren

Koenkk CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Koenkk CVE published 2026-08-05

CVE-2026-71279

The Zigbee2MQTT library is vulnerable to a path traversal attack through the ExternalJSExtension.getFilePath() function. This function, located in lib/extension/externalJS.ts, joins a name parameter received via an MQTT message into the extensions base path using path.join(basePath, name) without proper sanitization. As path.join() resolves ../ sequences, an attacker can exploit this by sending a name suc [truncated]