Path Traversal in Node-red
CVE-2026-71269
Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the us…
Vulnerability class: Path Traversal (Directory Traversal)
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Node-red — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-71269?
- CVE-2026-71269 is a high-severity vulnerability in Node-red, classified under Path Traversal. CVSS score: 7.2/10. Published 2026-08-05.
- How severe is CVE-2026-71269?
- High severity. CVSS v3 base score is 7.2 out of 10.