CVE-2026-114399
CVE-2026-114399 · Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
CVSS 7.0 · Alta · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
trudesk
- Versiones
- ≥ 0, ≤ 1.2.11: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/backuprestore.js#L108-L118
- https://github.com/polonel/trudesk/blob/v1.2.11/src/backup/restore.js#L69-L71
- https://github.com/polonel/trudesk
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-path-traversal-via-backup-delete-and-restore-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-114399