{"id":"CVE-2026-114398","kind":"vulnerability","aliases":["CVE-2026-114398"],"related":[],"title":"Trudesk: any logged-in user uploads scripts served as stored XSS","description":"Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.","summary":"Trudesk through 1.2.11 lets any authenticated user upload HTML or SVG files to the public webroot through the logo and favicon upload endpoints by spoofing an image MIME type. Those files are served without authentication from /assets/, so an attacker can run script in visitors' browsers and replace the instance branding.","severity":"medium","cvss":5.4,"epss":0.00182,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","package","self-hosted","trudesk"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check the installed Trudesk version (`package.json` in the Trudesk install directory) and see whether it is `1.2.11` or earlier.\n- Look for uploaded HTML or SVG files in the public assets directory under the Trudesk install (for example files served from `/assets/` that are not images).","fix":null,"status":"open","published_at":"2026-10-21T13:18:30+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:14:36+00:00","updated_at":"2026-10-25T04:14:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:14:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Trudesk: any logged-in user uploads scripts served as stored XSS","impact":"medium","summary":"Trudesk through 1.2.11 lets any authenticated user upload HTML or SVG files to the public webroot through the logo and favicon upload endpoints by spoofing an image MIME type. Those files are served without authentication from /assets/, so an attacker can run script in visitors' browsers and replace the instance branding.","category":"package","nicknames":[],"who_cares":["trudesk","self-hosted","node"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs script in visitors' browsers and replaces branding","analyst_note":"Check the Trudesk project for a patched release after 1.2.11 and confirm the fixed version; the NVD entry in the sources does not name one.","how_to_check":"- Check the installed Trudesk version (`package.json` in the Trudesk install directory) and see whether it is `1.2.11` or earlier.\n- Look for uploaded HTML or SVG files in the public assets directory under the Trudesk install (for example files served from `/assets/` that are not images).","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Self-hosted Trudesk instances at version 1.2.11 or earlier are exposed, since any user with a login can reach the upload endpoints. Instances where only trusted staff have accounts carry less risk, but the flaw still lets any account holder plant script on the public site. Teams on managed hosting should confirm with the vendor.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3402,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114398':15A,18A '-2026':14A,17A '/assets':61B,123C '1.2.11':27B,78C 'allow':86C 'attack':64B,107C 'authent':30B,59B,88C 'bear':118C 'brand':75B,134C 'browser':70B 'contain':79C 'cross':127C 'cross-sit':126C 'cve':13A,16A 'enabl':124C 'endpoint':47B,106C 'favicon':45B 'file':36B,55B,82C,95C,119C 'host':23B 'html':33B,92C 'imag':51B,111C 'instanc':74B,133C 'let':28B 'log':4A 'logged-in':3A 'logo':43B 'mime':52B,112C 'node':19B 'packag':20B 'place':91C 'public':39B,98C 'replac':72B,131C 'run':66B 'script':8A,67B,117C,129C 'script-bear':116C 'self':22B 'self-host':21B 'serv':9A,57B,120C 'site':128C 'spoof':49B,109C 'store':11A,125C 'svg':35B,94C 'trudesk':1A,24B,25B,76C 'type':53B,113C 'unauthent':121C 'unrestrict':81C 'upload':7A,32B,46B,83C,115C 'uploadfavicon':105C 'uploadlogo':102C 'uploadpagelogo':103C 'user':6A,31B,89C 'via':100C 'visitor':69B 'vulner':84C 'webroot':40B,99C 'without':58B 'xss':12A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Trudesk instances at version 1.2.11 or earlier are exposed, since any user with a login can reach the upload endpoints. Instances where only trusted staff have accounts carry less risk, but the flaw still lets any account holder plant script on the public site. Teams on managed hosting should confirm with the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114398","severity":null,"published_at":"2026-10-21T13:18:30+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114398","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114398","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}