Live › vulnerability › CVE-2026-114400
Go to dashboardTrudesk through 1.2.11 serves files under /uploads without checking login, because a static route for the public directory is matched first. An unauthenticated attacker who knows or guesses a ticket ID and filename can download confidential ticket attachments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Trudesk instance at version 1.2.11 or earlier that stores ticket attachments is exposed, and self-hosted instances reachable from the internet are the most at risk. Deployments that already block direct access to at a proxy, or that run no attachments, are less affected.
/uploadsNo product ranges from the sources yet.
1.2.11 or earlier.express.static setup that serves public/ ahead of the hasAuth-guarded /uploads mount in the Trudesk server code./uploads without a session cookie and see whether it returns the file.1.2.11; the sources do not name the fixed release, so check the vendor repository./uploads path behind authentication at the reverse proxy or block unauthenticated requests to it.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.
This page as .md · .json · in your agent: get_signal("CVE-2026-114400")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.