Medium severity · published Oct 21, 2026
CVE-2026-114398
Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
New
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
trudesk · polonel
through 1.2.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114398
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114398
github.com
https://github.com/polonel/trudesk
github.com
https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/main.js#L612-L837
github.com
https://github.com/polonel/trudesk/blob/v1.2.11/src/routes/index.js#L293-L295
hackmd.io
https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
www.vulncheck.com
https://www.vulncheck.com/advisories/trudesk-through-1.2.11-unrestricted-file-upload-via-settings-general-uploadlogo
More from trudesk
7.4
CVE-2026-114397
Trudesk through 1.2.11 Missing Authentication on Debug Routes
7.1
CVE-2026-114396
Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
6.5
CVE-2026-114399
Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
5.9
CVE-2026-114400
Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
5.3
CVE-2026-114401
Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login