The vulnerability arises in the upload PATCH flow of PsiTransfer. The flaw is a directory traversal vulnerability (CWE-22), where the application does not properly validate the mounted request path, allowing an attacker to craft a path that leads to the creation of a file named config.<NODE_ENV>.js in the application root. Because this file is loaded automatically on the next process restart, an unauthenticated attacker can inject and execute arbitrary JavaScript code when the service restarts, resulting in remote code execution with the privileges of the running process.

psi‑4ward PsiTransfer installations that use a custom PSITRANSFER_UPLOAD_DIR whose basename prefixes a server‑side JavaScript path, such as conf, are affected. All versions prior to 2.4.3 contain the flaw; version 2.4.3 and later include the path‑validation fix.

The CVSS score of 7.5 indicates a high severity, yet the EPSS score of less than 1% suggests the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to issue a PATCH request to /files/:uploadId and subsequently trigger a restart of the application. Once executed, it would provide full code execution on the host running PsiTransfer.