CVE-2026-41693 i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
Attackers can read or overwrite arbitrary files by manipulating language or namespace parameters in i18next-fs-backend due to unsanitized path interpolation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41693?
CVE-2026-41693 is a high-severity path traversal vulnerability in i18next-fs-backend, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2.6.4, i18next-fs-backend substitutes the lng and ns options directly into the configured loadPath / addPath templates and then read / write the resulting file from disk. The interpolation is unencoded and unvalidated, so a crafted lng or ns value — containing .., a path separator, a control character, a prototype key, or simply an unexpectedly long string — allows an attacker who can influence either value to read or overwrite files outside the intended locale directory. When lng / ns are derived from untrusted input (request-scoped i18next instances behind an HTTP layer such as i18next-http-middleware, or any framework that lets the end user pick the language via query string, cookie, or header), a single request such as ?lng=../../../../etc/passwd causes the backend to attempt to read that path. This issue has been patched in version 2.6.4.
Which versions are affected by CVE-2026-41693?
2 open source packages ship an affected version, including i18next-fs-backend.
| Package | Affected | Fixed in |
|---|---|---|
i18next-fs-backend npm | All versions | 2.6.4 |
i18next-fs-backend npm | All versions | 2.6.4 |
How do I fix CVE-2026-41693?
Upgrade i18next-fs-backend to 2.6.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-41693 being exploited?
There is no known exploitation of CVE-2026-41693 in the wild and no public exploit code.
Sources
Also known as GHSA-8847-338w-5hcj, MINI-2285-g6gg-j54g, MINI-rv6g-w6cj-c26r.