CVE-2026-114399Medium· 6.5▾ SunlitTrudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file value…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
trudesk <= 1.2.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114402Medium· 4.3Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
CVE-2026-114393Medium· 4.3Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
CVE-2026-114392Medium· 4.3Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
CVE-2026-114396High· 7.1Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
CVE-2026-114394Medium· 4.3Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
CVE-2026-114395Medium· 4.3Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send