{"id":"GHSA-533q-w4g6-5586","revision":null,"records":[{"revision":"992e6782346b4232a34f17139ea0e984","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41180","aliases":[],"title":"PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart","description":"PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `req.path`, but the downstream tus handler later writes using the decoded `req.params.uploadId`. In deployments that use a supported custom `PSITRANSFER_UPLOAD_DIR` whose basename prefixes a startup-loaded JavaScript path, such as `conf`, an unauthenticated attacker can create `config.<NODE_ENV>.js` in the application root. The attacker-controlled file is then executed on the next process restart. Version 2.4.3 contains a patch.","state":0,"publishedAt":"2026-04-23T00:10:58.23+00:00","modifiedAt":"2026-04-23T13:59:14.836+00:00","affected":[{"ecosystem":"Vendor product","name":"psitransfer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"psi-4ward\",\n                    \"product\": \"psitransfer\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.4.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-533q-w4g6-5586","https://github.com/psi-4ward/psitransfer/commit/8b547bf3e09757122efa00aab90281e3915aa0c6","https://github.com/psi-4ward/psitransfer/releases/tag/v2.4.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41180","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41180","identifiers":["CVE-2026-41180"]},"retained":false,"historicalAffected":[]},{"revision":"57afa814cae04eba926ab1b364c511aa","observedAt":"2026-10-27T10:10:07.342+00:00","statement":{"source":"nvd","id":"CVE-2026-41180","aliases":[],"title":"PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `req.path`, but the downstream tus handler l…","description":"PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `req.path`, but the downstream tus handler later writes using the decoded `req.params.uploadId`. In deployments that use a supported custom `PSITRANSFER_UPLOAD_DIR` whose basename prefixes a startup-loaded JavaScript path, such as `conf`, an unauthenticated attacker can create `config.<NODE_ENV>.js` in the application root. The attacker-controlled file is then executed on the next process restart. Version 2.4.3 contains a patch.","state":0,"publishedAt":"2026-04-23T02:16:15.977+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/psi-4ward/psitransfer/commit/8b547bf3e09757122efa00aab90281e3915aa0c6","https://github.com/psi-4ward/psitransfer/releases/tag/v2.4.3","https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-533q-w4g6-5586"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41180","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-04-23T02:16:15.977","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41180","identifiers":["CVE-2026-41180"]},"retained":false,"historicalAffected":[]},{"revision":"4c15b279e7294a7185530273a9df87ba","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-533q-w4g6-5586","aliases":["CVE-2026-41180"],"title":"PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart","description":"### Summary\n\nThe upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `req.path`, but the downstream tus handler later writes using the decoded `req.params.uploadId`. In deployments that use a supported custom `PSITRANSFER_UPLOAD_DIR` whose basename prefixes a startup-loaded JavaScript path, such as `conf`, an unauthenticated attacker can create `config.<NODE_ENV>.js` in the application root. The attacker-controlled file is then executed on the next process restart.\n\n### Details\n\nObserved in `2.4.1`, the upload middleware derives `fid` from `req.path.substring(1)` and calls `store.info(fid)` before handing the request to tus. For a request such as `/files/..%2Fconfig.production.js`, this outer check sees the encoded value `..%2Fconfig.production.js`. The downstream `patch('/:uploadId')` route, however, receives the decoded parameter `../config.production.js`. In the same code path, the `catch` branch uses `if(! e instanceof httpErrors.NotFound)`, which does not correctly stop execution on a missing upload target.\n\nThe write sink is `Store.getFilename(fid)`, which resolves `path.resolve(uploadDir, fid.replace('++', '/'))` and then only checks `startsWith(uploadDir)`. With a supported custom upload directory such as `<app_root>/conf`, the decoded target `../config.production.js` resolves to `<app_root>/config.production.js`, and the current string-prefix jail check still accepts it because the resolved path begins with `<app_root>/conf`.\n\nThe file creation is observable even when the request ends in failure. `store.append()` creates the target write stream first and only consults the JSON sidecar in the `finish` handler. As a result, `PATCH /files/..%2Fconfig.production.js` returns `404 Not Found` in my test, but still leaves an attacker-controlled `config.production.js` on disk.\n\nOn the next start, `config.js` executes `require(path.resolve(__dirname, \\`config.${process.env.NODE_ENV}.js\\`))` when the file exists. I verified this in a temporary copy of the application by setting `NODE_ENV=production` and `PSITRANSFER_UPLOAD_DIR` to a custom `conf` directory, sending a single PATCH request that wrote JavaScript into `config.production.js`, and then restarting the process. The attacker code executed during startup and created a proof file. Until a fix exists, the shortest safe workaround is to reject PATCH requests unless the expected sidecar metadata already exists and to avoid upload directory names that can prefix startup-loaded paths under the application root.\n\n### PoC\n\n1. Start PsiTransfer `2.4.1` from source with `NODE_ENV=production` and a supported custom upload directory whose basename prefixes a startup-loaded file path, for example `PSITRANSFER_UPLOAD_DIR=/opt/psitransfer/conf`.\n2. Send a PATCH request directly to the upload endpoint:\n\n```http\nPATCH /files/..%2Fconfig.production.js HTTP/1.1\nHost: target\nTus-Resumable: 1.0.0\nUpload-Offset: 0\nContent-Type: application/offset+octet-stream\n\nmodule.exports = {}; require('fs').writeFileSync('/tmp/psitransfer-rce-proof', 'owned');\n```\n\n3. Observe that the response is `404 Not Found`, but `/opt/psitransfer/config.production.js` is created and contains the attacker-controlled payload.\n4. Restart the PsiTransfer process, or wait for the next routine restart under the same `NODE_ENV`.\n5. Observe that `/tmp/psitransfer-rce-proof` is created during startup, confirming server-side JavaScript execution from the injected `config.production.js`.\n\n### Impact\n\nThe observed result is unauthenticated creation of an attacker-controlled startup configuration file outside the intended upload directory. In affected deployments, this becomes code execution with the PsiTransfer service account on the next process restart, allowing full compromise of the application's confidentiality, integrity, and availability within that execution context. Default Docker and default source/systemd examples did not satisfy the RCE precondition in my review because their documented upload directory names do not prefix startup-loaded paths, but the vulnerable logic is still reachable.","state":0,"publishedAt":"2026-04-16T21:13:40+00:00","modifiedAt":"2026-05-05T16:11:32.569502+00:00","affected":[{"ecosystem":"npm","name":"psitransfer","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.4.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-533q-w4g6-5586","https://nvd.nist.gov/vuln/detail/CVE-2026-41180","https://github.com/psi-4ward/psitransfer/commit/8b547bf3e09757122efa00aab90281e3915aa0c6","https://github.com/psi-4ward/psitransfer","https://github.com/psi-4ward/psitransfer/releases/tag/v2.4.3"],"sourceUrl":"https://github.com/advisories/GHSA-533q-w4g6-5586","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-533q-w4g6-5586","identifiers":["GHSA-533q-w4g6-5586","CVE-2026-41180"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T15:46:19.1555709+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T15:46:19.1555709+00:00","lastSuccessAt":"2026-10-27T15:46:19.3166108+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:19.3166123+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-67d02c0690a311a3477ecb30285e6a67bc5cbcf4b551d4b6cab698393621fd1a","complete":true,"records":415206,"lastAttemptAt":"2026-10-27T15:44:18.8922484+00:00","lastSuccessAt":"2026-10-27T15:44:18.7720642+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:44:18.8922484+00:00","snapshotPublishedAt":"2026-10-27T15:30:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T15:46:50.7636286+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13489},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T15:46:19.1555709+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T15:46:19.1555709+00:00","lastSuccessAt":"2026-10-27T15:46:21.5213865+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:21.5213883+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f81e3b22a8724ee290f14b0a1bb1aaf0","complete":false,"records":13426,"lastAttemptAt":"2026-10-27T15:46:48.5530959+00:00","lastSuccessAt":"2026-10-27T15:46:48.549+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:48.549+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13480,"expectedIdentifiers":13489},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-209ac5c5c1876448d270401dd7be9eb8338c977bffb106204e23f2a445f8dc56","complete":true,"records":9782,"lastAttemptAt":"2026-10-27T15:46:15.6695545+00:00","lastSuccessAt":"2026-10-27T15:46:15.4210182+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:15.6695545+00:00","snapshotPublishedAt":"2026-10-27T15:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T15:44:19.0567932+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:44:19.0567932+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-93fe8481574c33257e61d513a6f77ce9dae5c9ed681fabdfa367d09ba130127c","complete":true,"records":2997,"lastAttemptAt":"2026-10-27T15:46:19.1148938+00:00","lastSuccessAt":"2026-10-27T15:46:18.9862774+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:19.1148938+00:00","snapshotPublishedAt":"2026-10-27T15:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4cbf2f787207c0e5343fed347b333d6fe1c6a8461089bcb67e952c72cb90f6de","complete":true,"records":230822,"lastAttemptAt":"2026-10-27T15:46:07.9055861+00:00","lastSuccessAt":"2026-10-27T15:46:06.6649981+00:00","error":null,"lastVerifiedAt":"2026-10-27T15:46:07.9055861+00:00","snapshotPublishedAt":"2026-10-27T15:18:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}