Directory Traversal Vulnerability in Trigger.dev by Trigger.dev
CVE-2026-73659

8.1HIGH

Key Information:

Vendor

Triggerdotdev

Status
Trigger.dev
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73659?

Trigger.dev, an open-source platform for AI workflows implemented in TypeScript, has a directory traversal vulnerability affecting versions 4.4.2 through 4.5.0. This issue arises from the handling of filenames in the app's packet presign routes, which allows an attacker to manipulate file paths. By exploiting this flaw, attackers can escape the designated object-store prefix, enabling unauthorized access to read or overwrite task payloads linked to different organizations on self-hosted instances. The vulnerability was addressed in version 4.5.0.

Affected Version(s)

trigger.dev >= 4.4.2, < 4.5.0

References

https://github.com/triggerdotdev/trigger.dev/security/adv...
x_refsource_CONFIRM
https://github.com/triggerdotdev/trigger.dev/pull/3830
x_refsource_MISC
https://github.com/triggerdotdev/trigger.dev/commit/db407...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.