CVE-2026-71269 describes a path traversal vulnerability in Node-RED's local-filesystem library storage module affecting the getLibraryEntry() and saveLibraryEntry() functions. Authenticated users can supply crafted path parameters to access or modify arbitrary files outside the designated library directory. This flaw is distinct from a previously fixed traversal issue in Node-RED. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity, with impacts on confidentiality, integrity, and availability. No official patch or remediation is currently confirmed, and no known exploits in the wild have been reported.

Exploitation allows an authenticated user to read or write arbitrary files outside the intended library directory. If write access is exploited, this can lead to remote code execution, compromising system confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to authenticated users and monitor for suspicious activity related to library storage functions.