Path Traversal Vulnerability in Trudesk Affects Administrators
CVE-2026-114399

7HIGH

Key Information:

Vendor

Polonel

Status
Trudesk
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114399?

Trudesk version 1.2.11 is susceptible to a path traversal vulnerability that enables administrators to delete arbitrary files by sending encoded traversal sequences to the DELETE /api/v1/backup/:backup endpoint. Additionally, the vulnerability allows attackers to pass unvalidated file values to the POST /api/v1/backup/restore endpoint, enabling the restoration of archives or extraction to directories outside of the intended paths. This poses a significant risk as malicious users could manipulate file paths to access or modify sensitive files within the filesystem.

Affected Version(s)

trudesk 0 <= 1.2.11

References

https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
third-party-advisory
https://github.com/polonel/trudesk/blob/v1.2.11/src/contr...
technical-description
https://github.com/polonel/trudesk/blob/v1.2.11/src/backu...
technical-description

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.