Vulnerabilities

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal…

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

6.5

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-114399 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated…

   CVSS 4.3 CVE-2026-114402
2. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by…

   CVSS 5.3 CVE-2026-114401
3. 15
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments…

   CVSS 5.9 CVE-2026-114400 Cisco
4. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public…

   CVSS 5.4 CVE-2026-114398
5. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other…

   CVSS 4.3 CVE-2026-114395
6. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by…

   CVSS 4.3 CVE-2026-114394
7. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via…

   CVSS 4.3 CVE-2026-114393
8. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET…

   CVSS 4.3 CVE-2026-114392