CVE-2026-78435

Received Received - Intake

Path Traversal in Faveo Helpdesk Logo Handler

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-78435

Affected Vendors & Products

Vendor	Product	Version / Range
faveo_helpdesk	faveo_helpdesk	to 2.0.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Faveo Helpdesk versions up to 2.0.3. It exists in the Logo Handler component, specifically in the unlink function of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php. The vulnerability allows manipulation of the data1 argument to access or delete files outside intended directories. It can be exploited remotely and has been publicly disclosed.

Impact Analysis

An attacker could exploit this to delete arbitrary files on the server, potentially leading to denial of service, data loss, or unauthorized system access. Since it affects file handling, sensitive configurations or user data might be compromised if the attacker gains sufficient permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be impacted if sensitive data is exposed or altered due to the flaw.

Mitigation Strategies

Immediately upgrade Faveo Helpdesk to a version beyond 2.0.3 if an update is available. If no update exists, consider disabling the Logo Handler component in the admin panel or restricting access to the SettingsController.php file. Monitor network traffic for unusual path traversal attempts in file operations.

Hi! I’m here to help you understand CVE-2026-78435. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70