Is CVE-2026-41180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41180 being exploited in the wild.

How severe is CVE-2026-41180?

High severity, with a CVSS score of 7.5, published 23 April 2026.

Which products and versions are affected?

psitransfer (npm) < 2.4.3, SEMVER:introduced=0,fixed=2.4.3.

Is there a fix for CVE-2026-41180?

Yes. psitransfer (npm): upgrade to 2.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41180 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-41180?

Check whether you run psitransfer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41180: PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart

Q: Which products and versions are affected?

psitransfer (npm) < 2.4.3, SEMVER:introduced=0,fixed=2.4.3.

Q: Is there a fix for CVE-2026-41180?

Yes. psitransfer (npm): upgrade to 2.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41180 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-41180?

Check whether you run psitransfer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41180 · Severity: high · CVSS 7.5 · Published 2026-04-23

PsiTransfer is a self-hosted file-sharing application that allows users to upload and share files. A flaw in its upload handler allows an attacker to bypass path validation and create JavaScript configuration files outside the intended upload directory. When the application restarts, these malicious files are automatically executed with full application privileges, providing complete system compromise.

Technologies: psitransfer (npm). Vendors: npm.

Quick answers

Is CVE-2026-41180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41180 being exploited in the wild.
How severe is CVE-2026-41180?: High severity, with a CVSS score of 7.5, published 23 April 2026.
Which products and versions are affected?: psitransfer (npm) < 2.4.3, SEMVER:introduced=0,fixed=2.4.3.
Is there a fix for CVE-2026-41180?: Yes. psitransfer (npm): upgrade to 2.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41180 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-41180?: Check whether you run psitransfer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

psitransfer (npm): upgrade to 2.4.3 or later
```
npm install psitransfer@2.4.3
```

Technical details

The vulnerability is a path traversal flaw (CWE-22) in the upload PATCH endpoint under /files/:uploadId. The validation logic checks the still-URL-encoded req.path parameter to prevent directory traversal, but the downstream tus handler receives the decoded req.params.uploadId and uses that for the actual file write. By sending a request such as PATCH /files/..%2Fconfig.production.js with encoded path traversal sequences, an attacker can bypass the validation. Furthermore, an error-handling bug (incorrect instanceof check) allows execution to continue even when the target upload metadata does not exist. The write sink uses a simple string-prefix check that fails when the custom upload directory basename prefixes a startup-loaded path (e.g., PSITRANSFER_UPLOAD_DIR=/opt/psitransfer/conf allows writing to /opt/psitransfer/config.production.js). The application loads config.${NODE_ENV}.js on startup, executing any attacker-injected code. No authentication is required. The vulnerability was patched in version 2.4.3 and affects 2.4.1 and likely earlier versions.

Affected products

psi-4ward psitransfer all versions before 2.4.3

Identifiers

CVE-2026-41180
GHSA-533q-w4g6-5586

Timeline

2026-04-16: disclosed: GHSA-533q-w4g6-5586 published
2026-04-14: patched: Fix released in v2.4.3
2026-04-23: advisory: NVD entry CVE-2026-41180 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.