PT-2026-68152

Name of the Vulnerable Software and Affected Versions Zigbee2MQTT affected versions not specified Description An issue exists in the ExternalJSExtension.getFilePath function within lib/extension/externalJS.ts where a name parameter received via the MQTT topic...

CVE-2026-71279: Improper Limitation of a Pathname to a Restricted Directory

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...