CVE-2026-114398mediumCWE-434

CVE-2026-114398: fallo de gravedad media en polonel trudesk

Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear trudesk

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.3%
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Productos afectados
polonel · trudesk
CVEs relacionadas — polonel trudesk

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-114397HIGHTrudesk through 1.2.11 Missing Authentication on Debug RoutesEPSS 0.6%CVE-2026-114399HIGHTrudesk through 1.2.11 Path Traversal via Backup Delete and Restore APIEPSS 0.6%CVE-2026-114396HIGHTrudesk through 1.2.11 MongoDB $where Injection via tickets search APIEPSS 0.5%CVE-2026-114400HIGHTrudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploadsEPSS 0.5%CVE-2026-114401MEDIUMTrudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/loginEPSS 0.4%CVE-2026-114392MEDIUMTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uidEPSS 0.4%