The vulnerability exists in the ExternalJSExtension.getFilePath function of zigbee2mqtt, which constructs a file path by joining a base path with a user-supplied name parameter received through an MQTT topic. The only validation performed is that the filename ends with .js, .mjs, or .cjs, but no path sanitization is done to prevent directory traversal (CWE-22). This flaw enables an attacker with access to the MQTT topic zigbee2mqtt/bridge/request/extension/save to write malicious JavaScript files outside the intended directory and have them dynamically imported by Node.js, resulting in remote code execution.

An attacker with low privileges and access to the MQTT message topic can achieve remote code execution on the host running zigbee2mqtt. This compromises confidentiality, integrity, and availability of the system. The CVSS v3.1 score is 8.1 (high), reflecting the ease of exploitation and the severe impact on system control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the MQTT topic zigbee2mqtt/bridge/request/extension/save to trusted users only and monitor for suspicious activity related to extension saving. Avoid exposing the MQTT broker to untrusted networks.