CVE-2026-114398

Analyzed Analyzed - Analysis Complete

Trudesk Unrestricted File Upload Leading to Stored XSS

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: VulnCheck

Description

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114398

EUVD

EUVD-2026-107245

Affected Vendors & Products

Vendor	Product	Version / Range
trudesk_project	trudesk	to 1.2.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

CVE-2026-114398 is an unrestricted file upload vulnerability in Trudesk versions up to 1.2.11. It allows any authenticated user to upload HTML or SVG files to the public webroot by spoofing the MIME type. These files are served unauthenticated from the /assets/ directory, enabling stored cross-site scripting (XSS) attacks and allowing attackers to replace the instance's branding.

Detection Guidance

Check for unauthorized HTML or SVG files in the /assets/ directory of your Trudesk installation. Look for files uploaded via endpoints like /settings/general/uploadlogo, /uploadpagelogo, or /uploadfavicon. Verify MIME types of uploaded files to detect spoofing attempts.

Impact Analysis

Attackers can exploit this to upload malicious scripts that execute when users access the /assets/ directory. This could lead to stored XSS attacks, defacement of the application, or unauthorized actions performed on behalf of users. The vulnerability also allows attackers to replace branding elements, potentially misleading users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Stored XSS attacks may expose personal data, while unauthorized file uploads could compromise system integrity, leading to non-compliance with these regulations.

Mitigation Strategies

Upgrade Trudesk to a patched version beyond 1.2.11. Restrict file uploads to only allow safe file types (e.g., images). Implement strict MIME type validation for uploads. Review /assets/ directory for suspicious files and remove any unauthorized uploads.

Hi! I’m here to help you understand CVE-2026-114398. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...