---
id: "CVE-2026-114398"
kind: "vulnerability"
aliases: ["CVE-2026-114398"]
title: "Trudesk: any logged-in user uploads scripts served as stored XSS"
severity: "medium"
cvss: 5.4
epss: 0.00182
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node", "package", "self-hosted", "trudesk"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-21T13:18:30+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:14:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114398", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114398", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Trudesk: any logged-in user uploads scripts served as stored XSS

Trudesk through 1.2.11 lets any authenticated user upload HTML or SVG files to the public webroot through the logo and favicon upload endpoints by spoofing an image MIME type. Those files are served without authentication from /assets/, so an attacker can run script in visitors' browsers and replace the instance branding.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Trudesk version (`package.json` in the Trudesk install directory) and see whether it is `1.2.11` or earlier.
- Look for uploaded HTML or SVG files in the public assets directory under the Trudesk install (for example files served from `/assets/` that are not images).

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114398
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114398

## From the sources

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_