The vulnerability in Zigbee2MQTT's ExternalJSExtension.getFilePath() function arises from unsanitized use of a 'name' parameter received via MQTT messages. The function uses path.join(basePath, name) without sanitization, allowing path traversal sequences like '../' to escape the intended directory. The extension handler only checks that the filename ends with .js/.mjs/.cjs, then writes and dynamically imports the file using Node.js import(), enabling remote code execution. Additionally, the same unsanitized path handling is used in the extension removal handler, permitting arbitrary file deletion. Exploitation requires the 'enable_external_js' config option to be enabled and MQTT broker access, which is often unauthenticated in real deployments.

Successful exploitation allows an attacker with MQTT broker access and the 'enable_external_js' option enabled to execute arbitrary code remotely on the host running Zigbee2MQTT. It also permits arbitrary file deletion via the extension removal handler. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, disabling the 'enable_external_js' configuration option will prevent exploitation. Additionally, securing MQTT broker access with authentication and network controls can reduce exposure. Avoid enabling external JS extensions unless necessary.