Is CVE-2026-41180 actively exploited?

No active exploitation of CVE-2026-41180 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41180 be exploited remotely?

Yes. CVE-2026-41180 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-41180?

CVE-2026-41180 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-41180

HIGH

CVE-2026-41180

CWE-22Published: April 23, 2026· Updated: Apr 24, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:10.3th

Official Description

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `req.path`, but the downstream tus handler later writes using the decoded `req.params.uploadId`. In deployments that use a supported custom `PSITRANSFER_UPLOAD_DIR` whose basename prefixes a startup-loaded JavaScript path, such as `conf`, an unauthenticated attacker can create `config.<NODE_ENV>.js` in the application root. The attacker-controlled file is then executed on the next process restart. Version 2.4.3 contains a patch.

NVD Source

Technical Analysis

CVE-2026-41180 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.5.