CVE-2026-114398: Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-10-21 · updated 2026-10-29
Weakness: CWE-434

Description

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.

Affected products

polonel/trudesk: through 1.2.11
polonel/trudesk: through 1.2.11

References

https://github.com/polonel/trudesk
https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/main.js#L612-L837
https://github.com/polonel/trudesk/blob/v1.2.11/src/routes/index.js#L293-L295
https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
https://www.vulncheck.com/advisories/trudesk-through-1.2.11-unrestricted-file-upload-via-settings-general-uploadlogo
https://hackmd.io/@leediay/multiple-vuln-trudesk-1211

Get alerted when CVE-2026-114398 or the next vulnerability affects your stack