Executive brief
PsiTransfer is a self-hosted file-sharing application that allows users to upload and share files. A flaw in its upload handler allows an attacker to bypass path validation and create JavaScript configuration files outside the intended upload directory. When the application restarts, these malicious files are automatically executed with full application privileges, providing complete system compromise.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the upload PATCH endpoint under /files/:uploadId. The validation logic checks the still-URL-encoded req.path parameter to prevent directory traversal, but the downstream tus handler receives the decoded req.params.uploadId and uses that for the actual file write. By sending a request such as PATCH /files/..%2Fconfig.production.js with encoded path traversal sequences, an attacker can bypass the validation. Furthermore, an error-handling bug (incorrect instanceof check) allows execution to continue even when the target upload metadata does not exist. The write sink uses a simple string-prefix check that fails when the custom upload directory basename prefixes a startup-loaded path (e.g., PSITRANSFER_UPLOAD_DIR=/opt/psitransfer/conf allows writing to /opt/psitransfer/config.production.js). The application loads config.${NODE_ENV}.js on startup, executing any attacker-injected code. No authentication is required. The vulnerability was patched in version 2.4.3 and affects 2.4.1 and likely earlier versions.
Affected products
- psi-4ward psitransfer all versions before 2.4.3
Timeline
- 2026-04-16: disclosed: GHSA-533q-w4g6-5586 published
- 2026-04-14: patched: Fix released in v2.4.3
- 2026-04-23: advisory: NVD entry CVE-2026-41180 published