Vulnerability Description
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Trudesk Project | Trudesk | <= 1.2.11 |
Related Weaknesses (CWE)
References
- https://github.com/polonel/trudeskProduct
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/main.js#L612-L83Product
- https://github.com/polonel/trudesk/blob/v1.2.11/src/routes/index.js#L293-L295Product
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211ExploitThird Party Advisory
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-unrestricted-file-upThird Party Advisory
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211ExploitThird Party Advisory
FAQ
What is CVE-2026-114398?
CVE-2026-114398 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and upl...
How severe is CVE-2026-114398?
CVE-2026-114398 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114398?
Check the references section above for vendor advisories and patch information. Affected products include: Trudesk Project Trudesk.