Trudesk EUVD-2026-107245

Requires a valid authenticated Trudesk account of any privilege level (PR:L) with access to the Settings > General branding upload functionality, specifically the uploadlogo, uploadpagelogo, and uploadfavicon endpoints. The attacker must spoof an image MIME type so a script-bearing HTML or SVG file passes the image check, after which the file is served unauthenticated from /assets/. Exploitation is limited by three factors: it is not unauthenticated (an account is required), the stored-XSS payload only fires when a victim passively loads a page referencing the uploaded branding asset (UI:P), and it affects Trudesk instances running version 1.2.11 or earlier in their default self-hosted configuration.

This is a genuine but moderate-priority issue, consistent with its CVSS 4.0 base score of 5.1 (medium). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) indicates a network-reachable, low-complexity flaw that nevertheless requires authentication (PR:L) and passive victim interaction (UI:P) for the stored-XSS payload to execute - both of which meaningfully temper real-world risk. Impact is limited: no confidentiality or availability impact on the vulnerable system (VC:N/VA:N) and only low integrity impact (VI:L, i.e., branding replacement), with low subsequent-system impact (SC:L/SI:L) reflecting script execution in other users' browsers. No EPSS score, SSVC decision, or KEV entry was provided, so exploitation-probability signals are absent rather than low - this should not be read as 'safe,' only as 'unmeasured.' Exploitation status is 'no public exploit identified at time of analysis' per the supplied signals, though a detailed third-party technical writeup (hackmd) and source-line references exist, which lowers the barrier to developing a working exploit. Net: a real, authenticated stored-XSS/defacement bug worth patching, but not an emergency - the authentication and user-interaction requirements, plus niche product footprint, keep it below critical-priority thresholds.

A low-privileged authenticated Trudesk user uploads an SVG or HTML file carrying JavaScript through the Settings > General logo/favicon upload endpoints, spoofing an image MIME type to bypass validation. The file lands in the public webroot and is served unauthenticated from /assets/; when an administrator or another user loads a page referencing that branding asset, the stored script executes in their browser session. No public exploit code is identified at time of analysis, but a technical writeup describing the flaw is publicly available.