# CVE-2024-31454: PsiTransfer file integrity violation via PATCH endpoint

Source: https://junglewise.ai/threats/cve-2024-31454-psitransfer-file-integrity-violation-via-patch-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-04-05. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2024-31454 · Severity: low · CVSS 3.1 · Published 2024-04-05

PsiTransfer is a self-hosted file-sharing application used to distribute files to others. A security flaw allows an attacker to modify files that have already been uploaded by other users. This means a legitimate download link could be tampered with to deliver malicious software or phishing documents to unsuspecting recipients, damaging the integrity of the shared data and the reputation of the service.

Technologies: [psitransfer (npm)](https://junglewise.ai/threats/technologies/psitransfer). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-31454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-31454 being exploited in the wild.

**How severe is CVE-2024-31454?** Low severity, with a CVSS score of 3.1, published 5 April 2024.

**Which products and versions are affected?** psitransfer (npm) SEMVER:introduced=0,fixed=2.2.0.

**Is there a fix for CVE-2024-31454?** Yes. psitransfer (npm): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-31454 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-31454?** Check whether you run psitransfer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- psitransfer (npm): upgrade to 2.2.0 or later

  ```sh
  npm install psitransfer@2.2.0
  ```


## Technical details

A vulnerability exists in PsiTransfer due to a lack of access controls on the file upload endpoint. An attacker who obtains the unique ID of a file (typically visible during the download process) can send a 'PATCH /files/{{id}}' request with arbitrary content. The application appends the attacker-supplied data to the end of the original file content without verifying if the requester is the original uploader or if the distribution should be locked. This allows for the injection of malicious payloads into existing shared files. The issue is resolved in version 2.2.0 by implementing bucket locking after an upload is completed.

## Affected products

- psi-4ward psitransfer < 2.2.0

## Identifiers

- CVE-2024-31454
- GHSA-2p2x-p7wj-j5h2

## Timeline

- 2024-04-05: advisory: GitHub Security Advisory published
- 2024-04-05: patched: Fix committed to repository
- 2024-04-09: disclosed: CVE-2024-31454 assigned

## References

- [https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-2p2x-p7wj-j5h2](https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-2p2x-p7wj-j5h2)
- [https://github.com/psi-4ward/psitransfer/commit/0014d81141e0f1664ccb6841970ef1ea0237cca3](https://github.com/psi-4ward/psitransfer/commit/0014d81141e0f1664ccb6841970ef1ea0237cca3)
- [https://github.com/psi-4ward/psitransfer](https://github.com/psi-4ward/psitransfer)

## Related threats

- [PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart](https://junglewise.ai/threats/cve-2026-41180-psitransfer-upload-patch-path-traversal-can-create-config-node)
- [PsiTransfer path traversal in TAR archive download](https://junglewise.ai/threats/psitransfer-path-traversal-in-tar-archive-download-be4c501b)
- [PsiTransfer unrestricted file upload to distribution](https://junglewise.ai/threats/cve-2024-31453-psitransfer-unrestricted-file-upload-to-distribution)