Live › vulnerability › CVE-2026-114399
Go to dashboardTrudesk through 1.2.11 has a path traversal flaw in its backup API: encoded traversal sequences in DELETE /api/v1/backup/:backup let an administrator delete arbitrary files on the server. The backup restore endpoint also accepts unvalidated file paths, so archives can be read from or extracted to locations outside the intended directories.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run self-hosted Trudesk through 1.2.11 with administrator accounts that can reach the backup API. Exploitation requires administrator access, so the risk is mainly from compromised or malicious admin accounts. Instances that do not run Trudesk can skip it.
No product ranges from the sources yet.
1.2.11 are affected, per the NVD description.1.2.11; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
This page as .md · .json · in your agent: get_signal("CVE-2026-114399")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.