Node-RED's local-filesystem library storage exposes a REST endpoint that accepts a path fragment and directly concatenates it into an internal filesystem path using fspath.join(libDir, type, path). Because the implementation performs no sanitization, containment check, or path normalization of the user‑supplied component, an attacker can supply directory traversal sequences (for example, ../) to influence the resolved path. This allows the attacker to read arbitrary files outside the intended library directory or to write arbitrary files, potentially placing malicious code that the host will later execute, which can lead to remote code execution or other severe impacts.

The affected product is Node‑RED, specifically its local‑filesystem storage implementation. Any Node‑RED deployment that has the default filesystem storage enabled and exposes the /library/:lib/:type/*path endpoint is vulnerable. All versions of Node‑RED prior to the release that includes the mitigation are susceptible, including installations that are publicly accessible or that expose the endpoint to authenticated users.

The CVSS score of 7.2 indicates high severity, and EPSS data is very low (<1%), while the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation has not yet been observed. The flaw can be exploited by an authenticated attacker with read privileges to read sensitive files and by an attacker with write privileges to upload arbitrary files, which could lead to remote code execution. If an attacker can gain write access, the exploitation path is straightforward: a malicious payload can be uploaded and later executed by the host, granting full control.