CVE-2026-73659: Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API
Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and generatePresignedRequest in apps/webapp/app/v3/objectStore.server.ts, allowing .. traversal to escape the packets/<projectRef>/<env>/ object-store prefix and enabling a project API key to read or overwrite another organization's offloaded task payloads and outputs on multi-organization self-hosted instances. This issue is fixed in version 4.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
trigger.dev packet presign APIto a version that resolves this vulnerability.Fixed in 4.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73659?
The severity of CVE-2026-73659 is classified as high with a score of 8.1.
What kind of vulnerability is described in CVE-2026-73659?
CVE-2026-73659 is a path traversal vulnerability that allows cross-tenant object read/write.
How can I fix CVE-2026-73659?
To fix CVE-2026-73659, upgrade Trigger.dev to version 4.5.0 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-73659?
Users of Trigger.dev versions 4.4.2 to 4.5.0 are affected by CVE-2026-73659.
What is the impact of CVE-2026-73659?
The impact of CVE-2026-73659 includes the potential for unauthorized file access and exposure of sensitive data.