PsiTransfer before version 2.4.3 improperly limits pathname traversal in its upload PATCH flow at the `/files/:uploadId` endpoint. The validation uses the encoded request path, but the file write operation uses the decoded uploadId parameter, enabling an attacker to traverse directories and write files outside the intended directory. In deployments using a custom upload directory with a basename prefix matching a startup-loaded JavaScript path (e.g., 'conf'), an unauthenticated attacker can create files like `config.<NODE_ENV>.js` in the application root. These files are executed on process restart, allowing remote code execution. Version 2.4.3 contains a patch that addresses this issue.

An unauthenticated attacker can exploit this vulnerability to write arbitrary files into the application root directory, specifically attacker-controlled JavaScript files that are executed on the next process restart. This leads to remote code execution with the privileges of the application, potentially compromising confidentiality, integrity, and availability of the system. The CVSS score of 7.5 reflects high impact with network attack vector, high confidentiality, integrity, and availability impacts, but requiring user interaction and high attack complexity.

Version 2.4.3 of psitransfer contains a patch that fixes this path traversal vulnerability. Users should upgrade to version 2.4.3 or later to remediate the issue. Since this is a self-hosted application, patching is the primary mitigation. No vendor advisory content contradicts this; therefore, upgrading is strongly recommended.