CVE-2026-114398: Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Trudesk user can exploit the affected upload endpoints. The uploaded files are then served unauthenticated from the public /assets/ path, exposing other users who load or interact with the malicious content.
What does an attacker need to upload a malicious file?
The attacker needs valid authentication and must submit a file through uploadlogo, uploadpagelogo, or uploadfavicon. They can spoof an image MIME type to upload HTML or SVG files containing script content.
Are unauthenticated users affected?
Unauthenticated users cannot perform the upload, but they may be exposed to stored cross-site scripting because attacker-controlled files are publicly accessible from /assets/.
What can be done if patching is not immediately possible?
Restrict access to the affected endpoints to trusted administrative users and prevent HTML and SVG uploads, including files whose declared MIME type does not match their content. Review publicly served files under /assets/ and remove unexpected branding assets or script-bearing uploads.