Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 30 December 2025.

Which products and versions are affected?

psitransfer (npm) SEMVER:introduced=0,fixed=2.3.1.

Is there a fix for This vulnerability?

Yes. psitransfer (npm): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run psitransfer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

PsiTransfer path traversal in TAR archive download

Severity: low · CVSS 3.1 · Published 2025-12-30

PsiTransfer is a file-sharing application that allows users to upload and download files in bulk. A path traversal vulnerability in the archive download feature enables unauthenticated attackers to upload files with directory escape sequences (like "../../../") in filenames. When a victim extracts the resulting TAR archive, malicious files can be written anywhere on their filesystem, potentially leading to remote code execution.

Technologies: psitransfer (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 30 December 2025.
Which products and versions are affected?: psitransfer (npm) SEMVER:introduced=0,fixed=2.3.1.
Is there a fix for This vulnerability?: Yes. psitransfer (npm): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run psitransfer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

psitransfer (npm): upgrade to 2.3.1 or later
```
npm install psitransfer@2.3.1
```

Technical details

This is a Zip Slip path traversal vulnerability (CWE-22/CWE-23) in PsiTransfer's archive download functionality (lib/endpoints.js). The vulnerable code directly incorporates user-controlled file metadata.name into TAR archive entry names without sanitization. An unauthenticated attacker can exploit the TUS resumable upload protocol to upload a file with path traversal sequences in its filename metadata, then trigger archive download. When a victim extracts the .tar.gz file, the malicious entries write files outside the intended directory—for example, to ~/.ssh/authorized_keys or shell configuration files—enabling arbitrary code execution. The fix (released in v2.3.1) enforces safe filename validation.

Affected products

psi-4ward PsiTransfer <2.3.1

Timeline

2025-12-29: disclosed
2025-12-17: patched: Fix released in v2.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.