{"id":"CVE-2026-114399","kind":"vulnerability","aliases":["CVE-2026-114399"],"related":[],"title":"Trudesk: path traversal in backup API lets admins delete arbitrary files","description":"Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.","summary":"Trudesk through 1.2.11 has a path traversal flaw in its backup API: encoded traversal sequences in DELETE /api/v1/backup/:backup let an administrator delete arbitrary files on the server. The backup restore endpoint also accepts unvalidated file paths, so archives can be read from or extracted to locations outside the intended directories.","severity":"high","cvss":7.0,"epss":0.00511,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","package","self-hosted","trudesk"],"not_affected_if":["no-trudesk-instance","non-admin-only-users"],"how_to_check":"- Check the installed Trudesk version; versions through `1.2.11` are affected, per the NVD description.\n- Confirm whether the backup API is reachable from untrusted networks; the sources do not say whether it is exposed by default.","fix":"- Upgrade Trudesk to a version later than `1.2.11`; the fixed version is unknown from the sources.\n- Restrict access to /api/v1/backup/* to trusted administrators until patched.","status":"open","published_at":"2026-10-21T13:18:31+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:38:08+00:00","updated_at":"2026-10-25T03:38:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:38:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Trudesk to a version later than `1.2.11`; the fixed version is unknown from the sources.\n- Restrict access to /api/v1/backup/* to trusted administrators until patched.","reach":"network","title":"Trudesk: path traversal in backup API lets admins delete arbitrary files","impact":"high","summary":"Trudesk through 1.2.11 has a path traversal flaw in its backup API: encoded traversal sequences in DELETE /api/v1/backup/:backup let an administrator delete arbitrary files on the server. The backup restore endpoint also accepts unvalidated file paths, so archives can be read from or extracted to locations outside the intended directories.","category":"package","nicknames":[],"who_cares":["trudesk","self-hosted","node.js"],"confidence":0.6,"needs_auth":"yes","worst_case":"Administrator deletes or overwrites arbitrary files on the server host","analyst_note":"Check the Trudesk advisory or GitHub repo for the fixed version and whether the backup API is enabled by default.","how_to_check":"- Check the installed Trudesk version; versions through `1.2.11` are affected, per the NVD description.\n- Confirm whether the backup API is reachable from untrusted networks; the sources do not say whether it is exposed by default.","needs_analyst":true,"not_affected_if":["no-trudesk-instance","non-admin-only-users"],"who_is_affected":"Teams that run self-hosted Trudesk through 1.2.11 with administrator accounts that can reach the backup API. Exploitation requires administrator access, so the risk is mainly from compromised or malicious admin accounts. Instances that do not run Trudesk can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3382,"output_tokens":624,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114399':14A,17A '-2026':13A,16A '/api/v1/backup':41B,97C '/api/v1/backup/restore':108C '1.2.11':26B,77C 'accept':57B 'admin':8A 'administr':45B,85C 'allow':84C 'also':56B,101C 'api':6A,35B 'arbitrari':10A,47B,88C 'archiv':62B,111C 'attack':99C 'backup':5A,34B,42B,53B,98C 'contain':78C 'cve':12A,15A 'delet':9A,40B,46B,87C,96C 'directori':74B,120C 'encod':36B,92C 'endpoint':55B 'extract':68B,114C 'file':11A,48B,59B,89C,104C 'flaw':31B 'host':22B 'intend':73B,119C 'let':7A,43B 'locat':70B 'node.js':18B 'outsid':71B,117C 'packag':19B 'pass':102C 'path':2A,29B,60B,80C,116C 'post':107C 'read':65B 'restor':54B,110C 'self':21B 'self-host':20B 'sequenc':38B,94C 'server':51B 'suppli':91C 'travers':3A,30B,37B,81C,93C 'trudesk':1A,23B,24B,75C 'unvalid':58B,103C 'valu':105C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted Trudesk through 1.2.11 with administrator accounts that can reach the backup API. Exploitation requires administrator access, so the risk is mainly from compromised or malicious admin accounts. Instances that do not run Trudesk can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114399","severity":null,"published_at":"2026-10-21T13:18:31+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114399","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114399","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}