CVE-2026-114398

MediumCVSS 5.4/10Last modified Oct 29, 2026

Description

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Oct 21, 2026
Last modified
Oct 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1143996.5Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traCVE-2026-11448.8A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component AtomCVE-2026-114406.3A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-CVE-2026-1144007.5Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attaCVE-2026-1144015.3Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames byCVE-2026-1144024.3Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenCVE-2026-1144038.1PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHCVE-2026-1144046.1PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentatiCVE-2026-1144058.7Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 3CVE-2026-1144066.8The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA cerCVE-2026-1144076.1e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTMCVE-2026-1144088.7In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handl