Trudesk Project: >> Trudesk >> 1.1.9 Security Vulnerabilities
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
CVSS Score
7.0
EPSS Score
0.005
Published
2026-10-21
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.
CVSS Score
8.2
EPSS Score
0.006
Published
2026-10-21
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.
CVSS Score
6.9
EPSS Score
0.004
Published
2026-10-21
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
CVSS Score
5.1
EPSS Score
0.002
Published
2026-10-21
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service.
CVSS Score
7.2
EPSS Score
0.011
Published
2022-09-29
Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
CVSS Score
5.5
EPSS Score
0.007
Published
2022-09-29
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4.
CVSS Score
9.6
EPSS Score
0.029
Published
2022-06-20
Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.
CVSS Score
10.0
EPSS Score
0.032
Published
2022-06-20
Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3.
CVSS Score
9.1
EPSS Score
0.013
Published
2022-05-31
Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.
CVSS Score
8.8
EPSS Score
0.038
Published
2022-05-31
Page 1