CVE-2026-41180 Overview
CVE-2026-41180 is a path traversal vulnerability in PsiTransfer, an open source, self-hosted file sharing solution. The vulnerability exists in the upload PATCH flow under /files/:uploadId, where the application validates the mounted request path using the still-encoded req.path, but the downstream tus handler later writes using the decoded req.params.uploadId. This encoding mismatch allows unauthenticated attackers to write arbitrary files to the application root directory.
Critical Impact
In deployments using a supported custom PSITRANSFER_UPLOAD_DIR whose basename prefixes a startup-loaded JavaScript path (such as conf), an unauthenticated attacker can create config.<NODE_ENV>.js in the application root. This attacker-controlled file is then executed on the next process restart, leading to remote code execution.
Affected Products
- PsiTransfer versions prior to 2.4.3
Discovery Timeline
- 2026-04-23 - CVE CVE-2026-41180 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2026-41180
Vulnerability Analysis
This vulnerability is classified as CWE-22 (Path Traversal). The root cause lies in an inconsistency between how the application validates file paths and how it subsequently processes them. The upload endpoint at /files/:uploadId performs security validation against the URL-encoded version of the request path (req.path), but the underlying tus file handler operates on the URL-decoded version of req.params.uploadId.
This mismatch creates a window where path traversal sequences that appear benign in their encoded form (e.g., %2e%2e%2f for ../) pass validation but are decoded before the actual file write operation occurs. An attacker exploiting this flaw can escape the intended upload directory and write files to arbitrary locations within the application's filesystem permissions.
The attack is particularly severe in environments where the PSITRANSFER_UPLOAD_DIR configuration variable is set to a directory whose basename is a prefix of paths loaded during application startup. For example, if PSITRANSFER_UPLOAD_DIR is set to conf, an attacker can traverse to the application root and create a malicious config.<NODE_ENV>.js file that will be automatically loaded and executed when the Node.js application restarts.
Root Cause
The vulnerability stems from improper input validation where URL encoding inconsistencies allow path traversal attacks. The security check operates on encoded input while the file system operation uses decoded input, violating the principle of validating data in its canonical form.
Attack Vector
The attack is network-based and requires no authentication. An attacker can craft a malicious HTTP PATCH request to the /files/:uploadId endpoint with a specially crafted uploadId parameter containing URL-encoded path traversal sequences. The attack complexity is considered high due to the specific environmental requirements (custom upload directory configuration), and user interaction is required (process restart needed to trigger code execution).
The security patch introduced a new function decodedUploadPathSegment to properly handle path decoding before validation:
/** Decoded path segment under the /files mount (must match req.params used by tusboy). */
function decodedUploadPathSegment(req) {
const raw = req.path.startsWith('/') ? req.path.slice(1) : req.path;
try {
return decodeURIComponent(raw);
} catch {
return null;
}
}
Source: GitHub Commit Update
Detection Methods for CVE-2026-41180
Indicators of Compromise
- Unexpected files appearing in the PsiTransfer application root directory, particularly config.*.js files
- HTTP PATCH requests to /files/ endpoints containing URL-encoded path traversal sequences (%2e%2e%2f, %2e%2e/, ..%2f)
- Presence of unfamiliar JavaScript configuration files matching the pattern config.<environment>.js
- Unusual process behavior or network connections following application restarts
Detection Strategies
- Implement web application firewall (WAF) rules to detect and block URL-encoded path traversal patterns in request URIs
- Monitor file system integrity for the PsiTransfer application directory, alerting on creation of unexpected .js files
- Enable detailed access logging for the /files/ endpoint and analyze for suspicious patterns
- Deploy endpoint detection and response (EDR) solutions to monitor for anomalous file creation events in application directories
Monitoring Recommendations
- Configure SIEM rules to correlate HTTP PATCH requests with path traversal indicators targeting PsiTransfer endpoints
- Establish baseline behavior for file operations in the PsiTransfer directory and alert on deviations
- Monitor Node.js process startup events for loading of unexpected configuration files
- Implement network-level monitoring for outbound connections initiated immediately after PsiTransfer restarts
How to Mitigate CVE-2026-41180
Immediate Actions Required
- Upgrade PsiTransfer to version 2.4.3 or later immediately
- Audit the PSITRANSFER_UPLOAD_DIR configuration to ensure it does not use a basename that prefixes startup-loaded paths
- Review file system for any unexpected files in the application root directory
- Implement network segmentation to limit exposure of file sharing services
Patch Information
The vulnerability has been addressed in PsiTransfer version 2.4.3. The patch ensures that path validation occurs on the decoded form of the request path, preventing the encoding mismatch that enabled the traversal attack.
For detailed information about the fix, refer to:
Workarounds
- Place PsiTransfer behind a reverse proxy that performs URL decoding before path validation
- Configure PSITRANSFER_UPLOAD_DIR to use a directory name that does not prefix any application startup paths (avoid names like conf, config, lib, etc.)
- Implement strict file system permissions to prevent the application from writing outside designated upload directories
- Consider running PsiTransfer in a containerized environment with read-only filesystem for application code directories
# Configuration example - Use an upload directory that doesn't prefix startup paths
export PSITRANSFER_UPLOAD_DIR=/var/psitransfer/uploads
# Ensure strict permissions on application directory
chmod -R 755 /opt/psitransfer
chown -R root:root /opt/psitransfer
# Make uploads directory writable by application user only
mkdir -p /var/psitransfer/uploads
chown psitransfer:psitransfer /var/psitransfer/uploads
chmod 700 /var/psitransfer/uploads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
