# PsiTransfer path traversal in TAR archive download

Source: https://junglewise.ai/threats/psitransfer-path-traversal-in-tar-archive-download-be4c501b  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2025-12-30

PsiTransfer is a file-sharing application that allows users to upload and download files in bulk. A path traversal vulnerability in the archive download feature enables unauthenticated attackers to upload files with directory escape sequences (like "../../../") in filenames. When a victim extracts the resulting TAR archive, malicious files can be written anywhere on their filesystem, potentially leading to remote code execution.

Technologies: [psitransfer (npm)](https://junglewise.ai/threats/technologies/psitransfer). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 30 December 2025.

**Which products and versions are affected?** psitransfer (npm) SEMVER:introduced=0,fixed=2.3.1.

**Is there a fix for This vulnerability?** Yes. psitransfer (npm): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run psitransfer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- psitransfer (npm): upgrade to 2.3.1 or later

  ```sh
  npm install psitransfer@2.3.1
  ```


## Technical details

This is a Zip Slip path traversal vulnerability (CWE-22/CWE-23) in PsiTransfer's archive download functionality (lib/endpoints.js). The vulnerable code directly incorporates user-controlled file metadata.name into TAR archive entry names without sanitization. An unauthenticated attacker can exploit the TUS resumable upload protocol to upload a file with path traversal sequences in its filename metadata, then trigger archive download. When a victim extracts the .tar.gz file, the malicious entries write files outside the intended directory—for example, to ~/.ssh/authorized_keys or shell configuration files—enabling arbitrary code execution. The fix (released in v2.3.1) enforces safe filename validation.

## Affected products

- psi-4ward PsiTransfer <2.3.1

## Timeline

- 2025-12-29: disclosed
- 2025-12-17: patched: Fix released in v2.3.1

## References

- [https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-xphh-5v4r-r3rx](https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-xphh-5v4r-r3rx)
- [https://github.com/psi-4ward/psitransfer/commit/6c71bc0b8afa1ffa7aabd6c5fb28677651fd57b6](https://github.com/psi-4ward/psitransfer/commit/6c71bc0b8afa1ffa7aabd6c5fb28677651fd57b6)

## Related threats

- [PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart](https://junglewise.ai/threats/cve-2026-41180-psitransfer-upload-patch-path-traversal-can-create-config-node)
- [PsiTransfer file integrity violation via PATCH endpoint](https://junglewise.ai/threats/cve-2024-31454-psitransfer-file-integrity-violation-via-patch-endpoint)
- [PsiTransfer unrestricted file upload to distribution](https://junglewise.ai/threats/cve-2024-31453-psitransfer-unrestricted-file-upload-to-distribution)