Description
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
Affected products
trudesk_project: trudesk
References6
- hackmd.io/@leediay/multiple-vuln-trudesk-1211 ExploitThird Party Advisory
- hackmd.io/@leediay/multiple-vuln-trudesk-1211 ExploitThird Party Advisory
- github.com/polonel/trudesk Product
- github.com/polonel/trudesk/blob/v1.2.11/src/controllers/main.js… Product
- github.com/polonel/trudesk/blob/v1.2.11/src/routes/index.js#L29… Product
- www.vulncheck.com/advisories/trudesk-through-1.2.11-unrestricte… Third Party Advisory
Metrics
- CVSS 3.1
-
5.4
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 4.0
-
5.1
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 19 · as of 8 November 2026
- CWE
- CWE-434
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.