PsiTransfer before version 2.4.3 improperly limits pathname traversal in the upload PATCH flow at the `/files/:uploadId` endpoint. The vulnerability is due to validation of the request path using the still-encoded `req.path`, while the downstream handler writes using the decoded `req.params.uploadId`. In deployments using a custom upload directory with a basename prefix matching a startup-loaded JavaScript path (e.g., `conf`), an unauthenticated attacker can create malicious JavaScript files such as `config.<NODE_ENV>.js` in the application root. These files are executed on the next process restart, allowing code execution. Version 2.4.3 contains a patch addressing this issue.

An unauthenticated attacker can exploit this path traversal vulnerability to write arbitrary JavaScript files into the application root directory. Because these files are executed on process restart, the attacker can achieve remote code execution, leading to full compromise of the application. The CVSS score of 7.5 reflects high impact on confidentiality, integrity, and availability.

Upgrade to psi-4ward psitransfer version 2.4.3 or later, which contains a patch for this vulnerability. Until upgraded, restrict access to the upload endpoint and avoid using custom upload directories with basenames that overlap startup-loaded JavaScript paths. Patch status is not explicitly stated beyond the version 2.4.3 fix; check the vendor advisory for the latest remediation guidance.