Node-RED's local-filesystem library storage module exposes a REST endpoint that concatenates a user-supplied path directly into a filesystem path without sanitization, making the system vulnerable to classic path traversal. An attacker who is authenticated—either with full privileges or with a read-only token for reading, or with write access for creating files—can supply a path containing ../ sequences. This allows the actor to read any file outside the intended library directory, and with write permissions to create or overwrite files. Writing arbitrary files can lead to remote code execution, for example by placing a malicious key into a user's SSH authorized_keys or inserting a script into cron, thereby compromising the underlying host. The vulnerability originates from the getLibraryEntry() and saveLibraryEntry() functions in the localfilesystem module.

The affected product is Node-RED, specifically the local-filesystem storage implementation found in the packages/node_modules/@node-red/runtime/lib/storage/localfilesystem library. Any Node-RED installation that has the default filesystem storage enabled and exposes the /library/:lib/:type/*path endpoint is susceptible; this includes all versions prior to the patch that was released after detection of the flaw. Network exposure or admin-configured roles that allow authenticated users to invoke the endpoint will broaden the attack surface.

The CVSS score of 7.2 indicates high severity. EPSS data is not available, but the lack of listing in the CISA KEV catalog suggests no known exploitable code is widespread yet. The attack requires authentication, yet read-only tokens are sufficient to read arbitrary files, and write tokens can force remote code execution. If an attacker can gain write access, the exploitation path is straightforward: upload a malicious payload that is executed by the host, granting full control. Consequently, the practical risk is high for environments with publicly accessible Node-RED instances or where privileged users have outdated installations.