CVE-2026-114398
Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 21, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 21, 2026
Description
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
trudeskpolonel |
|
References
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211third-party-advisory
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/main.js#L612-L837technical-description
- https://github.com/polonel/trudesk/blob/v1.2.11/src/routes/index.js#L293-L295technical-description
- https://github.com/polonel/trudeskproduct
- VulnCheck Advisory: Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogothird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.