Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
CVE-2026-114398
CVSS base score
5.4 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-434
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
trudesk project trudesk
References
- github.com Product
- github.com Product
- github.com Product
- hackmd.io Exploit, Third Party Advisory
- www.vulncheck.com Third Party Advisory
- hackmd.io Exploit, Third Party Advisory