CVE-2026-114399: Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrator-level privileges to call the affected backup deletion or restore API endpoints. The available information does not indicate that unauthenticated or lower-privileged users can exploit it.
What actions can an attacker perform through the affected endpoints?
Using encoded traversal sequences with the backup deletion endpoint, an administrator can delete arbitrary files. The restore endpoint accepts unvalidated file values, allowing archives to be restored from or extracted to locations outside the intended directories.
Which versions are known to be affected?
Trudesk through version 1.2.11 is affected. The provided information does not identify a fixed version.