CVE-2026-114398
MEDIUM
5,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
434
Unrestricted Upload of File with Dangerous Type
DraftCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
Languages:
ASP.NET, PHP, Not Language-Specific
Technologies:
Web Server, AI/ML
https://github.com/polonel/trudesk
https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/main.js#L612-L8…
https://github.com/polonel/trudesk/blob/v1.2.11/src/routes/index.js#L293-L295
https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
https://www.vulncheck.com/advisories/trudesk-through-1.2.11-unrestricted-file-u…