Trudesk CVE-2026-114402

Requires an authenticated Trudesk account (PR:L) with access to the profile avatar upload endpoint (accountsController.uploadImage). The attacker must be able to submit the image-upload form and control the _id and username fields, supplying a path-traversal username (e.g., /../../../x) to defeat the incomplete CVE-2022-1752 sanitization. Exploitation is limited to writing files with png, jpg, jpeg, or gif extensions, and affects Trudesk versions through 1.2.11. Limiting factors: valid credentials are mandatory (no unauthenticated path), the write is constrained to image file extensions, and no user interaction by a victim is needed.

This is a moderate, authentication-gated integrity issue rather than a top-tier priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) is internally consistent with the description: network-reachable, low complexity, but requires an authenticated low-privileged account (PR:L) and yields only limited integrity impact (VI:L) with no confidentiality or availability loss. The vendor-assigned 5.3 (Medium) aligns with these metrics - there is no high-CVSS-vs-low-real-risk contradiction here. No EPSS score, KEV listing, or explicitly flagged POC was supplied, so there is no signal of active or widespread exploitation; exploitation requires a valid Trudesk login, which bounds the threat to users who already have authenticated access (e.g., any registered agent/end-user in a self-service deployment). One nuance to verify: the description frames this as a bypass of the incomplete CVE-2022-1752 fix and permits writing files outside public/uploads/users, which is arbitrary-file-write behavior; the restriction to image extensions (png/jpg/jpeg/gif) is the main factor limiting escalation to code execution, so VI:L (rather than a higher integrity rating) appears appropriate but the real-world blast radius depends on where writable paths lead on the host.

A logged-in Trudesk user (even a low-privilege account) submits a profile-image upload request while tampering with the form-supplied _id and username fields, setting username to a traversal string such as /../../../x. Because the CVE-2022-1752 sanitization is incomplete, the request writes the uploaded image outside public/uploads/users or overwrites another user's avatar, bypassing authorization. A linked HackMD write-up documents the vulnerability, but no confirmed public exploit code is flagged in the provided data.