Trudesk CVE-2026-114399

Requires an authenticated Trudesk administrator account (CVSS PR:H; description states 'allows administrators'), making admin-level access the hard prerequisite. The attacker must reach two specific backup-management endpoints: DELETE /api/v1/backup/:backup (arbitrary file deletion via encoded traversal sequences in the backup identifier) and POST /api/v1/backup/restore (unvalidated file value controlling the archive source/extraction path). The primary limiting factor is that these endpoints are administrator-restricted, so exploitation is confined to users who already hold the highest Trudesk privilege level; no end-user interaction is required once admin access is held.

This is a genuine integrity/availability flaw but a comparatively low operational priority. The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N, base 7.0) is internally consistent with the description: network-reachable (AV:N), low complexity (AC:L), but requires high privileges (PR:H) because the vulnerable backup endpoints are administrator-only. The impact is correctly scoped to integrity and availability (arbitrary file deletion/overwrite) with no confidentiality exposure (VC:N). No EPSS score, CISA KEV listing, or explicit POC flag was supplied in the input, so exploitation probability cannot be quantified from the data; absence of these signals is not evidence of safety but does mean there is no confirmed active exploitation. The PR:H requirement is the dominant mitigating factor - an attacker must already hold Trudesk administrator credentials, which sharply reduces the realistic threat population and makes this more of a post-compromise privilege-abuse / insider risk than a mass-exploitable perimeter vulnerability. Note the detailed third-party advisory (hackmd/VulnCheck) likely contains reproduction detail even though no POC=YES signal was passed in the structured input - verify the advisory directly before concluding exploit code does not exist.

An attacker who has obtained Trudesk administrator credentials (via phishing, credential reuse, or an insider) sends a DELETE request to /api/v1/backup/:backup containing URL-encoded ../ traversal sequences to remove arbitrary files on the server, or posts a crafted file value to /api/v1/backup/restore to write/extract archive contents outside the intended backup directory. This enables destruction of application or system files and potential file overwrite leading to corruption or denial of service. No POC status was confirmed in the structured input, though a public advisory documenting the issue exists.