Unrestricted File Upload Vulnerability in Trudesk by Polonel
CVE-2026-114398

5.1MEDIUM

Key Information:

Vendor

Polonel

Status
Trudesk
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114398?

The Trudesk application, up to version 1.2.11, is vulnerable to an unrestricted file upload issue that allows authenticated users to upload HTML or SVG files directly into the public webroot. This can occur through the uploadlogo, uploadpagelogo, and uploadfavicon endpoints. Attackers may exploit this weakness by spoofing the MIME type of an image file to upload script-bearing content. Consequently, unauthorized scripts can be served from the /assets/ directory, leading to stored cross-site scripting (XSS) vulnerabilities and potential alterations of the instance branding.

Affected Version(s)

trudesk 0 <= 1.2.11

References

https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
third-party-advisory
https://github.com/polonel/trudesk/blob/v1.2.11/src/contr...
technical-description
https://github.com/polonel/trudesk/blob/v1.2.11/src/route...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.