CVE-2026-114402: Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied id and username fields. Attackers can supply a username like /../../../x to bypass the incomplete CVE-2022-1752 sanitization and write png, jpg, jpeg, or gif files outside public/uploads/users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a Trudesk user. No user interaction is required, and the vulnerable upload endpoint is reachable over the network.
What access or input does an attacker need?
The attacker needs access to the profile image upload functionality and can submit form-supplied _id and username fields. A crafted username containing traversal sequences, such as /../../../x, can bypass the incomplete sanitization.
What can an attacker change?
An authenticated attacker can overwrite other users' avatar images and can write PNG, JPG, JPEG, or GIF files outside the intended public/uploads/users directory.
Are systems running the fixed version affected?
The issue affects Trudesk through version 1.2.11. The provided information does not identify a fixed version.