CVE-2026-114402

Analyzed Analyzed - Analysis Complete

Path Traversal in Trudesk Allows Avatar Overwrite

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: VulnCheck

Description

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attackers can supply a username like /../../../x to bypass the incomplete CVE-2022-1752 sanitization and write png, jpg, jpeg, or gif files outside public/uploads/users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114402

EUVD

EUVD-2026-107249

Affected Vendors & Products

Vendor	Product	Version / Range
trudesk_project	trudesk	to 1.2.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-114402 is a path traversal and authorization bypass vulnerability in Trudesk versions up to 1.2.11. It exists in the accountsController.uploadImage function where authenticated users can manipulate form fields to overwrite other users' profile images. Attackers supply a crafted username like /../../../x to bypass sanitization and write image files outside the intended directory.

Detection Guidance

Check for unauthorized file writes outside the public/uploads/users directory. Inspect logs for requests to accountsController.uploadImage with manipulated _id or username fields containing path traversal sequences like /../../../. Verify if user avatars have been unexpectedly modified or placed in unintended locations.

Impact Analysis

This vulnerability allows attackers to overwrite user avatars with malicious files. It could lead to unauthorized file uploads, potential defacement, or stored cross-site scripting attacks. Since it bypasses authorization checks, attackers can modify user profiles without proper permissions.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized access and modification of user data. The path traversal and authorization bypass allow attackers to overwrite user avatars, which may lead to unauthorized data access or tampering. GDPR requires protecting personal data integrity, while HIPAA mandates secure handling of protected health information. Unauthorized file writes outside intended directories could expose sensitive data, violating these regulations.

Mitigation Strategies

Upgrade Trudesk to a patched version beyond 1.2.11. If immediate upgrade is not possible, restrict write permissions to the public/uploads/users directory and implement strict input validation for _id and username fields in the accountsController.uploadImage endpoint. Monitor for suspicious file upload activities.

Hi! I’m here to help you understand CVE-2026-114402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...