CVE-2026-71279 describes a path traversal vulnerability in Zigbee2MQTT's ExternalJSExtension.getFilePath() function located in lib/extension/externalJS.ts. The function accepts a 'name' parameter from an MQTT message on the topic zigbee2mqtt/bridge/request/extension/save and passes it unsanitized to path.join(), allowing directory traversal via '../' sequences. An attacker can write arbitrary .js files outside the intended extensions directory, which are then dynamically imported via Node.js import(), resulting in remote code execution. The vulnerability requires the 'enable_external_js' configuration option to be enabled (off by default but common in legacy installs) and access to the MQTT broker, which is frequently unauthenticated in real-world deployments. The same vulnerable getFilePath() function is also used in the extension-removal handler, enabling arbitrary file deletion. The combination of unauthenticated MQTT brokers and legacy configurations makes this a high-severity risk in IoT and smart home environments.