CVE-2026-114402 in Trudesk
Summary
by MITRE • 10/22/2026
Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attackers can supply a username like /../../../x to bypass the incomplete CVE-2022-1752 sanitization and write png, jpg, jpeg, or gif files outside public/uploads/users.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Trudesk versions through 1.2.11 represents a critical combination of path traversal and authorization bypass flaws within the accountsController.uploadImage functionality. This security defect allows authenticated users to manipulate file system operations by supplying maliciously crafted input parameters, specifically targeting the _id and username fields associated with user profile updates. The core technical flaw lies in the insufficient sanitization of these inputs, which fails to adequately validate or restrict the directory paths used during image upload processes. By exploiting this weakness, an attacker can construct a payload that escapes the intended storage directory structure, effectively bypassing access controls designed to isolate user data within specific subdirectories such as public/uploads/users.
The operational mechanism of this exploit relies on the application's handling of relative path sequences in conjunction with incomplete fixes for previous vulnerabilities like CVE-2022-1752. When a user submits an image upload request, the backend processes the provided username field to determine the destination directory. If an attacker supplies a value containing traversal characters such as /../../../x, the application resolves this path relative to the current working directory rather than strictly within the designated uploads folder. This logic error permits the writing of files outside the restricted scope, allowing the injection of arbitrary content into sensitive areas of the file system or overwriting existing user assets. The vulnerability specifically supports common image formats including png, jpg, jpeg, and gif, which are typically processed by web servers for display purposes.
From a security impact perspective, this flaw enables unauthorized modification of other users' avatars, leading to potential reputational damage and social engineering opportunities where attackers impersonate legitimate administrators or colleagues. More critically, the ability to write files outside the intended directory can escalate into remote code execution if the application serves uploaded content directly from web-accessible locations without further validation. This scenario aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-284: Improper Access Control, highlighting both the path traversal aspect and the failure in enforcing authorization boundaries. The exploitation vector is classified under ATT&CK technique T1059.007: Command and Scripting Interpreter via file manipulation or T1136: Create Account if new accounts are created through similar mechanisms, though here it primarily facilitates lateral movement and identity spoofing within the application context.
Mitigation strategies must prioritize immediate patching to version 1.2.12 or later where these input validation checks have been strengthened. In environments where upgrading is not immediately feasible, administrators should implement strict allowlisting of permitted characters in username fields and enforce canonicalization of file paths before processing uploads. Additionally, configuring the web server to serve uploaded files from a separate directory with restricted execution permissions can mitigate the risk of code injection via malicious image metadata or embedded scripts. Regular auditing of upload handlers against CWE-434: Unrestricted Upload of File with Dangerous Type is also recommended to ensure that file type validation occurs at multiple layers, preventing both path traversal and unauthorized file placement within the application's infrastructure.