CVE-2026-114398

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.

• CWE-434

• https://github.com/polonel/trudeskProduct
• https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/main.js#L612-L837Product
• https://github.com/polonel/trudesk/blob/v1.2.11/src/routes/index.js#L293-L295Product
• https://hackmd.io/@leediay/multiple-vuln-trudesk-1211Exploit, Third Party Advisory
• https://www.vulncheck.com/advisories/trudesk-through-1.2.11-unrestricted-file-upload-via-settings-general-uploadlogoThird Party Advisory
• https://hackmd.io/@leediay/multiple-vuln-trudesk-1211Exploit, Third Party Advisory

Published

Oct 21, 2026

Last Modified

Oct 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114392Trudesk through 1.2.11 contains an authorization bypass vuln…5.3
• CVE-2026-114393Trudesk through 1.2.11 contains an authorization bypass vuln…4.3
• CVE-2026-114394Trudesk through 1.2.11 contains an authorization bypass vuln…4.3
• CVE-2026-114395Trudesk through 1.2.11 contains an authorization bypass vuln…4.3
• CVE-2026-114396Trudesk through 1.2.11 contains a server-side JavaScript inj…7.1
• CVE-2026-114397Trudesk through 1.2.11 contains a missing authentication vul…7.4
• CVE-2026-114399Trudesk through 1.2.11 contains a path traversal vulnerabili…6.5
• CVE-2026-1144A vulnerability was detected in quickjs-ng quickjs up to 0.1…8.8
• CVE-2026-11440A vulnerability was determined in theonedev onedev up to 15.…6.3
• CVE-2026-114400Trudesk through 1.2.11 contains a missing authentication vul…7.5
• CVE-2026-114401Trudesk through 1.2.11 contains a regular expression injecti…5.3
• CVE-2026-114402Trudesk through 1.2.11 contains a path traversal and authori…4.3