CVE-2026-114399
HIGH
7,0
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: high
Description
AI Translation Available
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
StableCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Modify Files Or Directories
Read Files Or Directories
Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies:
AI/ML
https://github.com/polonel/trudesk
https://github.com/polonel/trudesk/blob/v1.2.11/src/backup/restore.js#L69-L71
https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/backuprestore.j…
https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
https://www.vulncheck.com/advisories/trudesk-through-1.2.11-path-traversal-via-…