EUVD-2026-42970Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Local CLI admin access required (AV:L/PR:H); file overwrite without path control yields high integrity impact; critical file corruption causes availability loss; no confidentiality impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the coturn process because the command string is used as-is after stripping the psd prefix and leading spaces, allowing truncation and overwrite with session dump data. This issue is fixed in version 4.13.0.
AnalysisAI
Arbitrary file overwrite in Coturn prior to 4.13.0 is possible through the CLI management interface's psd (print sessions dump) command, which passes a user-supplied filename directly to fopen() without any path validation (CWE-73). An authenticated admin with CLI access can overwrite any file writable by the coturn process, potentially corrupting sensitive system files, certificates, or configuration data to achieve privilege escalation or service disruption. No public exploit identified at time of analysis; exploitation is constrained to local, high-privilege access, limiting realistic threat surface despite the High integrity and availability impact ratings.
Technical ContextAI
Coturn is a free, open-source implementation of the TURN (Traversal Using Relays around NAT) and STUN (Session Traversal Utilities for NAT) protocols, commonly deployed in WebRTC and VoIP infrastructure to relay real-time media. The vulnerability resides in the CLI management interface's psd command, which after stripping the 'psd' prefix and leading whitespace from the input string, passes the remainder directly to fopen() as a file path. CWE-73 (External Control of File Name or Path) describes this exact root cause: user-supplied input controlling a file path without sanitization or allowlisting. The coturn process user's OS-level write permissions define the blast radius - any file writable by that user (e.g., log files, certificates, cron entries, or configuration files) can be truncated and overwritten with session dump data. CPE cpe:2.3:a:coturn:coturn:*:*:*:*:*:*:*:* indicates all versions of the product are affected prior to the fix.
RemediationAI
Upgrade to Coturn 4.13.0, the vendor-released patched version available at https://github.com/coturn/coturn/releases/tag/4.13.0, which resolves the missing path validation in the psd CLI command. The specific fix commit is e72930f571beba3bc7a9f97661af2614aae92a55 (https://github.com/coturn/coturn/commit/e72930f571beba3bc7a9f97661af2614aae92a55). As a compensating control where immediate patching is not feasible, restrict CLI access to the coturn management interface to the minimum number of trusted, named administrators, and ensure the coturn process user account operates under the principle of least privilege with write access limited strictly to its own log and runtime directories. Note that filesystem-level restrictions on the coturn process user reduce but do not eliminate exposure, as session dump data overwriting even coturn-owned files could still corrupt service operation.
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. R
An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. Rated h
Coturn TURN/STUN server contains an access control bypass that allows remote attackers to reach blocked internal address
Stack buffer overflow in Coturn's OAuth token decoder (decode_oauth_token_gcm()) lets remote unauthenticated attackers c
Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a s
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. Rated
Server-side request forgery in coturn TURN/STUN server before 4.13.0 lets an authenticated TURN client bypass the defaul
SQL injection in the Coturn TURN/STUN server's HTTPS admin panel (versions prior to 4.12.0) allows an authenticated admi
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack m
Memory exhaustion in Coturn 4.15.0 allows an authenticated TURN user to crash or degrade server availability by abusing
Stored XSS in Coturn's web-admin HTTPS interface (all versions prior to 4.11.0) allows a TURN-level attacker to inject p
TCP/TLS stream parser desynchronization in Coturn TURN/STUN server prior to 4.15.0 allows any unauthenticated remote cli
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today