Path Traversal in Coturn Server CLI Command

Compliance Impact

CVE-2026-53449 allows an authenticated admin with CLI access to overwrite arbitrary files writable by the coturn process, including potentially sensitive configuration files and TLS certificates. This arbitrary file write vulnerability could lead to unauthorized modification or disruption of service, which may impact the confidentiality, integrity, and availability of data handled by the coturn server.

Such impacts could affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system configurations to prevent unauthorized access or data breaches. The ability to overwrite critical files without path validation increases the risk of data integrity violations and service disruptions, potentially leading to non-compliance with these regulations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-53449 is a vulnerability in the coturn TURN server prior to version 4.13.0. It involves the 'psd' (print sessions dump) CLI command, which takes a filename argument and passes it directly to the fopen function without any path validation.

An authenticated admin with CLI access can exploit this by specifying arbitrary filenames, allowing them to overwrite any file writable by the coturn process. This can include important files such as configuration files or TLS certificates.

The vulnerability arises because the command string is used as-is after stripping the 'psd' prefix and leading spaces, enabling truncation and overwrite with session dump data. The issue was fixed in version 4.13.0 by removing the 'psd' command entirely and eliminating the file-output functionality.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated CLI admin to overwrite arbitrary files writable by the coturn process. This can lead to several impacts:

• Overwriting configuration files, potentially disrupting service or changing server behavior.
• Overwriting TLS certificates or other critical files, which could compromise security or cause denial of service.
• Partial control over the content of overwritten files, which might be used to inject malicious data or disrupt operations.

Overall, exploitation can lead to service disruption and compromise of server integrity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the coturn server's CLI command `psd` which allows an authenticated admin to overwrite arbitrary files by specifying a filename argument without path validation.

Detection can focus on monitoring usage of the `psd` command on the coturn server, especially any unusual or unauthorized file write attempts triggered by this command.

Since the vulnerability requires CLI access with admin privileges, checking coturn server logs for `psd` command usage or attempts to write to unexpected files can help detect exploitation.

• Check coturn CLI command history or logs for usage of the `psd` command.
• Use system commands to monitor file changes in directories writable by the coturn process, for example:
• - `lsof -p $(pidof coturn)` to see open files by the coturn process.
• - `inotifywait` or similar tools to watch for file modifications in coturn writable directories.
• Review coturn configuration and ensure no unauthorized CLI access is possible.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade coturn to version 4.13.0 or later, where the vulnerable `psd` command has been removed entirely.

Until the upgrade can be applied, restrict CLI admin access to trusted users only, as exploitation requires authenticated CLI access.

Additionally, monitor and audit CLI usage to detect any attempts to use the `psd` command.

Consider restricting file system permissions so that the coturn process user cannot write to sensitive files or directories.

Useful 0 Not Useful 0