Koenkk vulnerabilities

Products

• zigbee2mqtt 1

Latest Koenkk CVEs

Newest publication first

1. CVE-2026-71279 Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

   Published 2026-08-05

   High·CVSS 8.1 EPSS 0.57%

   Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler o...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.