Vulnerabilities

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated…

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attackers can supply a username like /../../../x to bypass the incomplete CVE-2022-1752 sanitization and write png, jpg, jpeg, or gif files outside public/uploads/users.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

4.3

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-114402 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by…

   CVSS 5.3 CVE-2026-114401
2. 15
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments…

   CVSS 5.9 CVE-2026-114400 Cisco
3. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal…

   CVSS 6.5 CVE-2026-114399
4. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public…

   CVSS 5.4 CVE-2026-114398
5. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other…

   CVSS 4.3 CVE-2026-114395
6. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by…

   CVSS 4.3 CVE-2026-114394
7. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via…

   CVSS 4.3 CVE-2026-114393
8. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET…

   CVSS 4.3 CVE-2026-114392