CVE-2026-114398
Trudesk Project Trudesk: unrestricted file upload
- Risk score
- 41/100
- CVSS
- 5.4 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from…
- Affected
- Trudesk Project Trudesk
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Trudesk Project Trudesk: Amber, patch this week. Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.
The flaws
- CVE-2026-114398: Unrestricted file upload (CVSS 5.4 · EPSS 0%)
- CVE-2026-114397: Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled… (CVSS 7.4 · EPSS 1%)
- CVE-2026-114400: Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated… (CVSS 7.5 · EPSS 0%)
- CVE-2026-114396: Denial of service (CVSS 7.1 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Trudesk Project Trudesk
Where it stands
- Public proof of concept
Connects to
- Same weakness: Unrestricted file upload (CWE-434). 135 other warnings in 30 days
- Same product: Earlier Trudesk Project Trudesk warnings. 7 in the last 90 days
Why it is Yellow
- CVSS 5.4 medium
- Public exploit or proof of concept referenced
References
- https://github.com/polonel/trudesk
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/main.js#L612-L837
- https://github.com/polonel/trudesk/blob/v1.2.11/src/routes/index.js#L293-L295
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-unrestricted-file-upload-via-settings-general-uploadlogo
Original description
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
Last activity 21 Oct 2026. Patch Forecast updates every hour.