i18next-fs-backend, a Node.js and Deno backend for loading translations from the filesystem, prior to version 2.6.4, improperly handles the lng and ns parameters by directly interpolating them into file path templates without validation or encoding. This allows an attacker who can influence these parameters—commonly derived from user input in HTTP requests—to craft values containing directory traversal sequences (e.g., ../../) or other malicious characters to read or overwrite arbitrary files outside the intended directory. This is a classic external control of file name or path vulnerability (CWE-73) combined with directory traversal (CWE-22). The issue is fixed in version 2.6.4.

An attacker able to control the lng or ns parameters can exploit this vulnerability to read sensitive files or overwrite files on the server filesystem outside the intended translation directories. This can lead to information disclosure (e.g., reading /etc/passwd) or limited integrity impact by overwriting files. The CVSS 3.1 base score is 8.2, reflecting high impact on confidentiality and some impact on integrity, with no impact on availability. There are no known exploits in the wild as of the published date.

Upgrade i18next-fs-backend to version 2.6.4 or later, where this vulnerability is patched. Until upgraded, avoid using untrusted input to set the lng or ns options or implement strict validation and sanitization to prevent directory traversal sequences and other malicious input. Since this is a code-level vulnerability, patching is the primary and recommended remediation.