A critical path traversal vulnerability in PsiTransfer enables unauthenticated attackers to achieve remote code execution, posing a severe risk to the integrity and availability of the host system.

This is a path traversal (CWE-22) flaw occurring in the /files/:uploadId endpoint. An unauthenticated attacker can manipulate the request path to write a malicious JavaScript file to the application root, which is subsequently executed upon service restart.

The ability for an unauthenticated user to execute arbitrary code on the host server represents a total compromise of the application environment. This could lead to data exfiltration, unauthorized access to internal file systems, and complete loss of control over the affected server, justifying the high CVSS score of 7.5.

Immediate Action: Update the PsiTransfer installation to version 2.4.3 or later immediately to incorporate the provided fix.

Proactive Monitoring: Review application logs for unusual file creation events or attempts to access configuration files within the application root directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns, such as sequences containing dot-dot-slash, in incoming HTTP requests.

Public Exploit Available: Unknown.

Given the potential for full remote code execution, organizations utilizing PsiTransfer must prioritize upgrading to version 2.4.3. This patch effectively closes the directory traversal vector, preventing attackers from injecting malicious configurations into the application directory. Failure to remediate this vulnerability leaves the host susceptible to complete system compromise.