CVE-2026-114402
CVE-2026-114402 · Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attackers can supply a username like /../../../x to bypass the incomplete CVE-2022-1752 sanitization and write png, jpg, jpeg, or gif files outside public/uploads/users.
CVSS 5.3 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
trudesk
- Versiones
- ≥ 0, ≤ 1.2.11: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/accounts.js#L454-L553
- https://github.com/polonel/trudesk
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-path-traversal-and-authorization-bypass-via-profile-image-upload
- https://nvd.nist.gov/vuln/detail/CVE-2026-114402