Zigbee2MQTT's ExternalJSExtension.getFilePath() function concatenates a user supplied file name from an MQTT message into the extensions directory without sanitization. The use of path.join allows a crafted name containing "../" segments to escape to any location. An attacker can therefore submit a file name such as "../../tmp/evil.js", causing the gateway to write the malicious script to an arbitrary directory and then dynamically import it with Node.js import(), executing arbitrary code. The extension removal handler shares the same vulnerable logic, allowing arbitrary file deletion. The weakness is a classic Path Traversal flaw, identified as CWE-22, which directly enables remote code execution and data compromise. Affected Systems: The vulnerable code resides in the Koenkk:zigbee2mqtt project, specifically the Zigbee2MQTT application. All installations that enable the "enable_external_js" configuration option – which is off by default but was commonly left on in legacy deployments – are susceptible. The vulnerability is independent of a particular release version; however, newer releases have addressed the issue. The application typically receives MQTT messages on the "zigbee2mqtt/bridge/request/extension/save" topic.

The undocumented vulnerable logic exists in all Koenkk:zigbee2mqtt application releases where the external JavaScript extension feature is enabled. Any environment running Zigbee2MQTT with enable_external_js set to true, regardless of the host operating system, is at risk. This includes legacy installations that have not applied the recent fix or have not disabled the feature. The exploit targets the gateway component that handles MQTT traffic and can affect connected smart home devices through the bridge.

The CVSS score of 8.1 indicates a high severity condition for this vulnerability. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The exploitation requires an attacker to publish a specially crafted MQTT message to a broker that the gateway subscribes to. In many real deployments the broker is unauthenticated or has weak access controls, which makes the attack vector highly feasible. If successful, the attacker gains full remote code execution on the host running Zigbee2MQTT, compromising confidentiality, integrity, and availability of both the gateway and any connected devices.