An unauthenticated path traversal vulnerability in the i18next-fs-backend package for Node.js and Deno allows remote attackers to read or overwrite arbitrary files on the filesystem, presenting a high risk to application integrity and data confidentiality.

This is a path traversal and external control of file name or path vulnerability, driven by unvalidated substitution of language and namespace parameters into filesystem templates, allowing unauthenticated remote access.

A successful exploit could allow malicious actors to read sensitive system files, access internal configuration data, or overwrite application files to achieve persistence or compromise system operations. With a CVSS score of 8.2, this high severity vulnerability reflects the danger of unauthenticated remote file access against underlying server environments.

Immediate Action: Update the i18next-fs-backend package to version 2.6.4 or later immediately.

Proactive Monitoring: Monitor application error logs and file access patterns for anomalous traversal attempts or unexpected file read operations originating from web requests.

Compensating Controls: Implement strict input validation and sanitization on request parameters handling language selection to reject characters such as dot-dot sequences or path separators before they reach the backend layer.

Public Exploit Available: No (no confirmed public exploit or proof-of-concept exists in the available data).

Organizations utilizing the i18next-fs-backend library must treat this issue with high urgency due to the potential for arbitrary file access. Applying the official vendor patch to version 2.6.4 is the definitive remediation step to eliminate the exposure surface.