CVE-2026-114083: Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

Q: Who can exploit this issue?

An attacker needs a valid API key for an authenticated tenant. No user interaction is required, and exploitation can be performed remotely.

Q: What access could an attacker gain?

A tenant with a valid API key can use ../ sequences to obtain presigned GET or PUT URLs outside its assigned object-key prefix. This can allow reading or overwriting other tenants' run payloads and outputs.

Q: Which versions should be remediated?

Trigger.dev versions before 4.5.0-rc.3 are affected. Upgrade to 4.5.0-rc.3 or a later version.

Published Oct 21, 2026

Updated

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.5.0-rc.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Trigger.dev to a version that resolves this vulnerability.
Fixed in 4.5.0-rc.3

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a valid API key for an authenticated tenant. No user interaction is required, and exploitation can be performed remotely.

What access could an attacker gain?

A tenant with a valid API key can use ../ sequences to obtain presigned GET or PUT URLs outside its assigned object-key prefix. This can allow reading or overwriting other tenants' run payloads and outputs.

Which versions should be remediated?

Trigger.dev versions before 4.5.0-rc.3 are affected. Upgrade to 4.5.0-rc.3 or a later version.

CVE-2026-114083: Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain?

Which versions should be remediated?