Zigbee2MQTT's ExternalJSExtension.getFilePath function joins a file name supplied via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base directory using path.join(basePath, name) with no sanitization. The only validation performed is that the filename ends with .js/.mjs/.cjs; the code then writes the file and immediately imports it using the Node.js import() function, providing an attacker with the ability to create arbitrary files elsewhere on the host and execute them. This flaw is a classic path traversal vulnerability (CWE‑22) that directly enables remote code execution. An attacker who can publish a crafted MQTT message can cause the gateway to write a malicious script to an arbitrary location, load it, and run it with the privileges of the Zigbee2MQTT process, compromising the host and potentially any connected smart‑home devices.

The vulnerable logic exists in all Koenkk:zigbee2mqtt releases where the external JavaScript extension feature is enabled. Any environment running Zigbee2MQTT with enable_external_js set to true, regardless of host operating system, is at risk. The exploitation is performed through the MQTT bridge that processes messages on the bridge request topic, potentially impacting connected smart‑home devices via the bridge.

The CVSS score of 8.1 indicates a high severity condition for this vulnerability. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to publish a specially crafted MQTT message to a broker that the gateway subscribes to. In many real deployments the broker is unauthenticated or has weak access controls, making the attack vector highly feasible. If successful, the attacker gains full remote code execution on the host running Zigbee2MQTT, compromising confidentiality, integrity, and availability of both the gateway and any connected devices.