---
id: "CVE-2026-114399"
kind: "vulnerability"
aliases: ["CVE-2026-114399"]
title: "Trudesk: path traversal in backup API lets admins delete arbitrary files"
severity: "high"
cvss: 7.0
epss: 0.00511
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node.js", "package", "self-hosted", "trudesk"]
not_affected_if: ["no-trudesk-instance", "non-admin-only-users"]
published_at: "2026-10-21T13:18:31+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:38:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114399", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114399", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Trudesk: path traversal in backup API lets admins delete arbitrary files

Trudesk through 1.2.11 has a path traversal flaw in its backup API: encoded traversal sequences in DELETE /api/v1/backup/:backup let an administrator delete arbitrary files on the server. The backup restore endpoint also accepts unvalidated file paths, so archives can be read from or extracted to locations outside the intended directories.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Trudesk version; versions through `1.2.11` are affected, per the NVD description.
- Confirm whether the backup API is reachable from untrusted networks; the sources do not say whether it is exposed by default.

## Fix

- Upgrade Trudesk to a version later than `1.2.11`; the fixed version is unknown from the sources.
- Restrict access to /api/v1/backup/* to trusted administrators until patched.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114399
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114399

## From the sources

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_