PsiTransfer has Zip Slip Path Traversal via TAR Archive Download

Description

A Zip Slip vulnerability in PsiTransfer allows an unauthenticated attacker to upload files with path traversal sequences in the filename (e.g. ../../../.ssh/authorized_keys). When a victim downloads the bucket as a .tar.gz archive and extracts it, malicious files are written outside the intended directory, potentially leading to RCE.

Recommendation

Update the psitransfer package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.1
• Patched version(s): 2.3.1

References

• GHSA-xphh-5v4r-r3rx
• CWE-22
• CWE-23
• OWASP 2021-A1

Related Issues

• ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction - CVE-2026-32731
• Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
• jsPDF has Local File Inclusion/Path Traversal vulnerability - CVE-2025-68428
• liquidjs has a path traversal fallback vulnerability - CVE-2026-30952

Tags:

npm

psitransfer