i18next-fs-backend substitutes the language (lng) and namespace (ns) options directly into configured file path templates without encoding or validation. A crafted value containing directory traversal sequences, path separators, or control characters allows an attacker to read or overwrite files outside the intended locale directory, potentially exposing sensitive data or executing arbitrary code if overwriting executable files. This vulnerability is identified as CWE-22 and CWE-73.

The affected product is i18next i18next-fs-backend. All versions released before 2.6.4 are vulnerable; upgrades to 2.6.4 or later provide a patch.

The CVSS score of 8.2 indicates high impact and exploitability. EPSS data is not available and the vulnerability is not listed in CISA KEV. The likely attack vector involves a web application that creates request‑scoped instances of i18next, allowing an attacker to influence the language selection via query string, cookie, header, or other user‑controlled inputs. A single crafted request such as ?lng=../../../../etc/passwd would cause the backend to read that file, revealing credentials or system information, while writing to a critical file could lead to remote code execution.