Live › vulnerability › CVE-2026-114398
Go to dashboardTrudesk through 1.2.11 lets any authenticated user upload HTML or SVG files to the public webroot through the logo and favicon upload endpoints by spoofing an image MIME type. Those files are served without authentication from /assets/, so an attacker can run script in visitors' browsers and replace the instance branding.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Trudesk instances at version 1.2.11 or earlier are exposed, since any user with a login can reach the upload endpoints. Instances where only trusted staff have accounts carry less risk, but the flaw still lets any account holder plant script on the public site. Teams on managed hosting should confirm with the vendor.
No product ranges from the sources yet.
package.json in the Trudesk install directory) and see whether it is 1.2.11 or earlier./assets/ that are not images).Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
This page as .md · .json · in your agent: get_signal("CVE-2026-114398")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.