i18next-fs-backend, a filesystem backend for i18next in Node.js and Deno, prior to version 2.6.4, improperly handles interpolation of the lng and ns options into file path templates. Because these values are unencoded and unvalidated, an attacker able to control them can craft inputs containing directory traversal sequences (e.g., ../../) or other special characters to read or write files outside the intended translation directories. This vulnerability is classified under CWE-73 (External Control of File Name or Path) and CWE-22 (Path Traversal). The issue is mitigated by upgrading to version 2.6.4 where proper validation and encoding are implemented.

An attacker who can influence the lng or ns parameters, typically through HTTP request parameters or headers in applications using i18next-fs-backend, can exploit this vulnerability to read arbitrary files on the filesystem or overwrite files outside the intended translation directories. This can lead to unauthorized disclosure of sensitive information (confidentiality impact is high) and limited integrity impact due to potential file overwrites. There is no direct availability impact reported. The CVSS 3.1 base score is 8.2 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact.

This vulnerability is fixed in i18next-fs-backend version 2.6.4. Users should upgrade to version 2.6.4 or later to ensure proper validation and encoding of lng and ns parameters to prevent directory traversal. Until upgraded, applications should avoid using untrusted input directly for these parameters or implement strict input validation and sanitization to block path traversal sequences. No vendor advisory was provided, so patch status is based on the CVE description. Patch status is confirmed by the statement that the issue has been patched in version 2.6.4.