Faveo Helpdesk CVE-2026-78435

Exploitation requires an authenticated session with high (administrator-level) privileges in Faveo Helpdesk, as confirmed by PR:H in the CVSS 4.0 vector. The vulnerable code path is the Logo Handler within the admin settings panel (SettingsController.php), meaning the admin interface must be reachable over the network (AV:N). No special non-default configuration is required beyond having a functional Faveo Helpdesk 2.0.x deployment. Exploitation is limited by the following factors: the attacker must possess or obtain valid admin credentials; the impact is file deletion only (no code execution, no data read); and the affected versions are specifically 2.0.0-2.0.3, so organizations not running the 2.0.x branch are unaffected. User interaction is not required once the attacker is authenticated.

The CVSS 4.0 base score of 2.0 (Low) accurately reflects the constrained real-world risk. The PR:H requirement is the dominant mitigating factor: exploitation demands an existing authenticated session with admin-level privileges, substantially narrowing the attacker population. An attacker who already holds admin credentials in a helpdesk system has numerous alternative destructive paths, making this vulnerability incremental rather than transformative. EPSS data was not provided in the input, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in the wild at time of analysis. However, a publicly available POC (GitHub issue) lowers the bar for any attacker who does gain admin access. VI:L and VA:L (low integrity and availability impact) suggest the practical damage is file deletion - potentially disruptive if critical configuration or application files are targeted, but not equivalent to code execution or data exfiltration. The absence of a vendor patch and the vendor's non-response elevate residual risk for unmitigated deployments. Overall: low priority for most organizations, elevated only for internet-exposed Faveo admin panels without compensating access controls.

An attacker who has obtained valid admin credentials to a Faveo Helpdesk 2.0.x instance - whether through credential stuffing, phishing, or prior compromise - navigates to the Logo Handler settings page and submits a crafted POST request with a data1 parameter containing path traversal sequences (e.g., ../../config/database.php). The application passes this value directly to unlink(), deleting the targeted file. A publicly available POC via GitHub issue #8343 demonstrates the technique, lowering the skill threshold for any privileged attacker.