Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Published: 2026-08-05
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Node-RED to the latest version that includes path‑sanitization for the library storage API.
  • If immediate upgrading is not possible, restrict access to the /library/:lib/:type/*path endpoint to high‑privilege users and disable it for anonymous or read‑only tokens.
  • Monitor system logs for unexpected file read or write activity outside the library directory and regularly audit critical files such as SSH authorized_keys and cron jobs for unauthorized modifications.

Generated by OpenCVE AI on August 10, 2026 at 20:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References

No reference.

History

Wed, 16 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Title Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Description Node-RED's local-filesystem library storage module (getLibraryEntry and saveLibraryEntry in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification. An authenticated user (including read-only-scoped tokens for the read path) can supply a path containing `../` sequences to read arbitrary files outside the library directory; a user with write access can write arbitrary files, enabling remote code execution via SSH authorized_keys or cron injection. This is a distinct, separately unpatched traversal from the previously fixed CVE-2021-21298 (Projects API). Node-RED's local-filesystem library storage module (getLibraryEntry and saveLibraryEntry in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification.
Title Node-RED - Library API Path Traversal Leading to Arbitrary File Read/Write Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write Node-RED - Library API Path Traversal Leading to Arbitrary File Read/Write

Fri, 07 Aug 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Nodered
Nodered node-red
Vendors & Products Nodered
Nodered node-red

Wed, 05 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Description Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification. An authenticated user (including read-only-scoped tokens for the read path) can supply a path containing `../` sequences to read arbitrary files outside the library directory; a user with write access can write arbitrary files, enabling remote code execution via SSH authorized_keys or cron injection. This is a distinct, separately unpatched traversal from the previously fixed CVE-2021-21298 (Projects API).
Title Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Nodered Node-red
cve-icon MITRE

Status: REJECTED

Assigner: TuranSec

Published:

Updated: 2026-09-16T05:56:02.196Z

Reserved: 2026-08-05T12:23:34.967Z

Link: CVE-2026-71269

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-05T13:24:51.207

Modified: 2026-09-16T06:16:31.323

Link: CVE-2026-71269

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T20:30:05Z

Weaknesses

No weakness.