PsiTransfer RCE: Unauthenticated Code Execution via Path Traversal

The National Vulnerability Database has detailed CVE-2026-41180, a critical vulnerability in PsiTransfer, an open-source file sharing solution. Prior to version 2.4.3, an unauthenticated attacker could achieve remote code execution (RCE). The flaw stems from an inconsistency in how the upload PATCH flow validates request paths versus how the downstream tus handler processes them.

Specifically, the system validates the still-encoded req.path but later writes using the decoded req.params.uploadId. This discrepancy, in conjunction with custom PSITRANSFER_UPLOAD_DIR configurations that prefix a startup-loaded JavaScript path (like conf), allows an attacker to create a config.<NODE_ENV>.js file in the application root. This attacker-controlled file then executes on the next process restart.

This is a severe path traversal issue (CWE-22) with a CVSS score of 7.5 (High). Defenders need to prioritize patching, as the attack requires no authentication and can lead to full system compromise. The attacker’s calculus here is straightforward: exploit a common path validation bypass to inject and execute arbitrary code, gaining persistent control over the server. PsiTransfer version 2.4.3 includes the necessary patch.